Vulnerability · Published Jun 21, 2022 · Assigned by CERTVDE
CVE-2022-31800Insufficient Verification of Data Vulnerability in PHOENIX CONTACT classic line industrial controllers
Critical 9.8
In plain English
A critical-severity insufficient verification of data authenticity in AXC 1050 from PHOENIX CONTACT. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 75% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.6%top 24.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PHOENIX CONTACT | ILC 1x0 | All Versions |
| PHOENIX CONTACT | ILC 1x1 | All Versions |
| PHOENIX CONTACT | ILC 1x1 GSM/GPRS | All Versions |
| PHOENIX CONTACT | ILC 3xx | All Versions |
| PHOENIX CONTACT | AXC 1050 | All Versions |
| PHOENIX CONTACT | AXC 1050 XC | All Versions |
| PHOENIX CONTACT | AXC 3050 | All Versions |
| PHOENIX CONTACT | RFC 480S PN 4TX | All Versions |
| PHOENIX CONTACT | RFC 470 PN 3TX | All Versions |
| PHOENIX CONTACT | RFC 470S PN 3TX | All Versions |
| PHOENIX CONTACT | RFC 460R PN 3TX | All Versions |
| PHOENIX CONTACT | RFC 460R PN 3TX-S | All Versions |
| PHOENIX CONTACT | RFC 430 ETH-IB | All Versions |
| PHOENIX CONTACT | RFC 450 ETH-IB | All Versions |
| PHOENIX CONTACT | PC WORX SRT | All Versions |
| PHOENIX CONTACT | PC WORX RT BASIC | All Versions |
| PHOENIX CONTACT | FC 350 PCI ETH | All Versions |
Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://cert.vde.com/en/advisories/VDE-2022-025/ x_refsource_CONFIRM