Vulnerability · Published Dec 14, 2023 · Assigned by CERTVDE
CVE-2023-5592Phoenix Contact: ProConOs prone to Download of Code Without Integrity Check
High 7.5
In plain English
A high-severity security flaw in MULTIPROG from PHOENIX CONTACT. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.3%top 73.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to download and execute applications without integrity checks on the device which may result in a complete loss of integrity.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PHOENIX CONTACT | MULTIPROG | all |
| PHOENIX CONTACT | ProConOS eCLR (SDK) | all |
Weakness: CWE-494 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N