CVE-2020-12497: Phoenix Contact Automation Worx <= 1.87: stack-based overflow

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 14.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-07-01 · updated 2026-06-17
Weakness: CWE-121

Description

PLCopen XML file parsing in Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier can lead to a stack-based overflow. Manipulated PC Worx projects could lead to a remote code execution due to insufficient input data validation.

Affected products

PHOENIX CONTACT PC Worx: before 1.87 — fixed in 1.87
PHOENIX CONTACT PC Worx Express: through 1.87

How to fix

Upgrade to a fixed version: PHOENIX CONTACT PC Worx 1.87. Check the vendor advisory for mitigations.

References

https://cert.vde.com/de-de/advisories/vde-2020-023
https://www.zerodayinitiative.com/advisories/ZDI-20-825/
https://www.zerodayinitiative.com/advisories/ZDI-21-398/
https://cert.vde.com/de-de/advisories/vde-2020-023
https://www.zerodayinitiative.com/advisories/ZDI-20-825/
https://www.zerodayinitiative.com/advisories/ZDI-21-398/

Get alerted when CVE-2020-12497 or the next vulnerability affects your stack