What’s Vulnerable › Vulnerabilities

CVE-2023-46144: PHOENIX CONTACT: PLCnext Control prone to download of code without integrity check

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-12-14 · updated 2026-06-17
• Weakness: CWE-494

Description

A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with low privileges to compromise integrity on the affected engineering station and the connected devices.

Affected products

• Phoenixcontact Axc F 1152 Firmware: through 2024.0
• Phoenixcontact Axc F 2152 Firmware: through 2024.0
• Phoenixcontact Axc F 3152 Firmware: through 2024.0
• Phoenixcontact Bpc 9102S Firmware: through 2024.0
• Phoenixcontact Epc 1502 Firmware: through 2024.0
• Phoenixcontact Epc 1522 Firmware: through 2024.0
• PHOENIX CONTACT PLCnext Engineer: through 2024.0
• Phoenixcontact Rfc 4072R Firmware: through 2024.0
• Phoenixcontact Rfc 4072S Firmware: through 2024.0

References

• https://https://cert.vde.com/en/advisories/VDE-2023-056/
• https://https://cert.vde.com/en/advisories/VDE-2023-056/

Get alerted when CVE-2023-46144 or the next vulnerability affects your stack