Vulnerability · Published Dec 14, 2023 · Assigned by CERTVDE
CVE-2023-0757Phoenix Contact ProConOS prone to Incorrect Permission Assignment for Critical Resource
Critical 9.8
In plain English
A critical-severity incorrect permission assignment in MULTIPROG from PHOENIX CONTACT. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.9%top 40.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Incorrect Permission Assignment for Critical Resource vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to upload arbitrary malicious code and gain full access on the affected device.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PHOENIX CONTACT | MULTIPROG | all |
| PHOENIX CONTACT | ProConOS eCLR (SDK) | all |
Weakness: CWE-732 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H