What’s Vulnerable › Vulnerabilities

CVE-2022-31800: Insufficient Verification of Data Vulnerability in PHOENIX CONTACT classic line industrial controllers

• Severity: critical (CVSS 10.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-06-21 · updated 2026-06-17
• Weakness: CWE-345

Description

An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.

Affected products

• Phoenixcontact Axc 1050 Firmware: all versions
• Phoenixcontact Axc 1050 Xc Firmware: all versions
• Phoenixcontact Axc 3050 Firmware: all versions
• Phoenixcontact Fc 350 Pci Eth Firmware: all versions
• Phoenixcontact Ilc1X0 Firmware: all versions
• Phoenixcontact Ilc1X1 Firmware: all versions
• Phoenixcontact Ilc 1X1 Gsm/Gprs Firmware: all versions
• Phoenixcontact Ilc 3Xx Firmware: all versions
• Phoenixcontact Pc Worx Rt Basic Firmware: all versions
• Phoenixcontact Pc Worx Srt Firmware: all versions
• Phoenixcontact Rfc 430 Eth-Ib Firmware: all versions
• Phoenixcontact Rfc 450 Eth-Ib Firmware: all versions
• Phoenixcontact Rfc 460R Pn 3Tx-S Firmware: all versions
• Phoenixcontact Rfc 460R Pn 3Tx Firmware: all versions
• Phoenixcontact Rfc 470 Pn 3Tx Firmware: all versions
• Phoenixcontact Rfc 470S Pn 3Tx Firmware: all versions
• Phoenixcontact Rfc 480S Pn 4Tx Firmware: all versions

References

• https://cert.vde.com/en/advisories/VDE-2022-025/
• https://cert.vde.com/en/advisories/VDE-2022-025/

Get alerted when CVE-2022-31800 or the next vulnerability affects your stack