CVE-2023-46144
Medium
Description
A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with low privileges to compromise integrity on the affected engineering station and the connected devices.
SeverityMedium
CVSS6.5
Exploit probability—
ProductPhoenixcontact Plcnext Engineer
PublishedDec 14, 2023
First seenDec 14, 2023
Weakness typeCWE-494CWE-494
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phoenixcontact plcnext_engineer | v ≤ 2024.0 | — |
| phoenixcontact axc_f_1152_firmware | v ≤ 2024.0 | — |
| phoenixcontact axc_f_2152_firmware | v ≤ 2024.0 | — |
| phoenixcontact axc_f_3152_firmware | v ≤ 2024.0 | — |
| phoenixcontact bpc_9102s_firmware | v ≤ 2024.0 | — |
| phoenixcontact epc_1502_firmware | v ≤ 2024.0 | — |
| phoenixcontact epc_1522_firmware | v ≤ 2024.0 | — |
| phoenixcontact rfc_4072r_firmware | v ≤ 2024.0 | — |
| phoenixcontact rfc_4072s_firmware | v ≤ 2024.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.