CVE-2023-46141: Phoenix Contact: Automation Worx and classic line controllers prone to Incorrect Permission Assignment for Critical Resource

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-14 · updated 2026-06-17
Weakness: CWE-732

Description

Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full access of the affected device.

Affected products

Phoenixcontact Automationworx Software Suite: all versions
Phoenixcontact Axc 1050 Firmware: all versions
Phoenixcontact Axc 1050 Xc Firmware: all versions
Phoenixcontact Axc 3050 Firmware: all versions
PHOENIX CONTACT Config+: all versions
Phoenixcontact Fc 350 Pci Eth Firmware: all versions
Phoenixcontact Ilc1X0 Firmware: all versions
Phoenixcontact Ilc1X1 Firmware: all versions
Phoenixcontact Ilc 3Xx Firmware: all versions
PHOENIX CONTACT PC Worx: all versions
PHOENIX CONTACT PC Worx Express: all versions
Phoenixcontact Pc Worx Rt Basic Firmware: all versions
PHOENIX CONTACT PC WORX SRT: all versions
Phoenixcontact Rfc 430 Eth-Ib Firmware: all versions
Phoenixcontact Rfc 450 Eth-Ib Firmware: all versions
Phoenixcontact Rfc 460R Pn 3Tx Firmware: all versions
Phoenixcontact Rfc 470S Pn 3Tx Firmware: all versions
Phoenixcontact Rfc 480S Pn 4Tx Firmware: all versions

References

Get alerted when CVE-2023-46141 or the next vulnerability affects your stack