CVE-2023-46141CWE-732

Phoenix Contact: Automation Worx and classic line controllers prone to Incorrect Permission Assignment for Critical Resource

Critical · published December 14, 2023

CVSS v3.1
9.8
EPSS
1%
Percentile
58.7
In the wild
Unconfirmed
What it is

🚨 A misstep in permission handling could let an attacker waltz right in—no password needed! 🔥 Think of it like a hotel that accidentally left its doors wide open; anyone can check in and access the VIP lounge without a room key. This vulnerability is just as startling—granting full access to unauthorized users! An attacker could gain complete control over affected devices, allowing them to change settings, access sensitive data, or even disrupt operations entirely. Imagine the chaos if anyone could alter critical configurations—it's an absolute nightmare!

Put simply

Think of it like a hotel that accidentally left its doors wide open; anyone can check in and access the VIP lounge without a room key. This vulnerability is just as startling—granting full access to unauthorized users! This vulnerability arises from incorrect permission assignments in a variety of PHOENIX CONTACT classic line products, allowing remote unauthenticated access to critical resources without proper authorization verification.

What to do

An attacker could gain complete control over affected devices, allowing them to change settings, access sensitive data, or even disrupt operations entirely. Imagine the chaos if anyone could alter critical configurations—it's an absolute nightmare! Patch your devices immediately to the latest version provided by PHOENIX CONTACT. Review and tighten your permission settings to ensure only authorized personnel can access critical resources. Conduct regular audits to spot any similar vulnerabilities. You've got this! By taking these steps, you'll fortify your defenses and keep your devices safe from intruders. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00879 · 58.7th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2023-12-14T14:05Z
EPSS history
Timeline
  • 14 DEC 14:05Z
    Phoenix Contact: Automation Worx and classic line controllers prone to Incorrect Permission Assignment for Critical Resource
    cvelistv5