PT-2019-3743 · Phoenix Contact · Pc Worx+2
Published
2019-03-06
·
Updated
2019-06-27
·
CVE-2019-12869
CVSS v2.0
9.3
High
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
PHOENIX CONTACT PC Worx versions 1.86 and earlier
PHOENIX CONTACT PC Worx Express versions 1.86 and earlier
PHOENIX CONTACT Config+ versions 1.86 and earlier
Description
An issue in the affected software allows a manipulated project file to cause an Out-Of-Bounds Read, potentially leading to Information Disclosure and remote code execution. The attacker must first obtain an original project file, manipulate it, and then exchange it with the original file on the application programming workstation. This could allow a remote attacker to disclose protected information and execute arbitrary code using a managed project file.
Recommendations
For PHOENIX CONTACT PC Worx versions 1.86 and earlier, consider restricting access to project files to minimize the risk of exploitation.
For PHOENIX CONTACT PC Worx Express versions 1.86 and earlier, avoid using potentially manipulated project files until a fix is available.
For PHOENIX CONTACT Config+ versions 1.86 and earlier, as a temporary workaround, consider disabling the use of project files from untrusted sources until a patch is available.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Config+
Pc Worx
Pc Worx Express