CVE-2023-46143: Phoenix Contact: Classic line industrial controllers prone to inadequate integrity check of PLC

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-14 · updated 2026-06-17
Weakness: CWE-494

Description

Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all applications on a PLC.

Affected products

Phoenixcontact Automationworx Software Suite: all versions
Phoenixcontact Axc 1050 Firmware: all versions
Phoenixcontact Axc 1050 Xc Firmware: all versions
Phoenixcontact Axc 3050 Firmware: all versions
PHOENIX CONTACT Config+: all versions
Phoenixcontact Fc 350 Pci Eth Firmware: all versions
Phoenixcontact Ilc1X0 Firmware: all versions
Phoenixcontact Ilc1X1 Firmware: all versions
Phoenixcontact Ilc 3Xx Firmware: all versions
PHOENIX CONTACT PC Worx: all versions
PHOENIX CONTACT PC Worx Express: all versions
Phoenixcontact Pc Worx Rt Basic Firmware: all versions
PHOENIX CONTACT PC WORX SRT: all versions
Phoenixcontact Rfc 430 Eth-Ib Firmware: all versions
Phoenixcontact Rfc 450 Eth-Ib Firmware: all versions
Phoenixcontact Rfc 460R Pn 3Tx Firmware: all versions
Phoenixcontact Rfc 470S Pn 3Tx Firmware: all versions
Phoenixcontact Rfc 480S Pn 4Tx Firmware: all versions

References

Get alerted when CVE-2023-46143 or the next vulnerability affects your stack