CVE-2022-3461 - CVE House
Back to Database
Status published High CVE-2022-3461

Buffer Overflow in PHOENIX CONTACT Automationworx Software Suite

Vulnerability Description

In PHOENIX CONTACT Automationworx Software Suite up to version 1.89 manipulated PC Worx or Config+ files could lead to a heap buffer overflow and a read access violation. Availability, integrity, or confidentiality of an application programming workstation might be compromised by attacks using these vulnerabilities.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-3461

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • This vulnerability was discovered by Michael Heinzl

References

More from PHOENIX CONTACT

View All →
CVE-2025-41668
Phoenix Contact: File access due to the replacement of a critical file used by the service security-profile
High 8.8
CVE-2025-41667
Phoenix Contact: File access due to the replacement of a critical file used by the arp-preinit script
High 8.8
CVE-2025-41666
Phoenix Contact: File access due to the replacement of a critical file used by the watchdog
High 8.8
CVE-2025-41665
Phoenix Contact: DoS of the PLC due to incorrect default permissions possible
Medium 6.5
CVE-2024-7734
Phoenix Contact: Multiple mGuard devices are vulnerable to a drain of open file descriptors.
Medium 5.3

Affected Vendor

PHOENIX CONTACT

View all reports →

Affected Software

Config+, PC Worx, PC Worx Express
Vulnerable Versions:
0

Timeline

Official Publish: November 15th, 2022
Last Modified: April 29th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-119

MITRE ATT&CK TTPs

T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1203 Exploitation for Client Execution
Execution
T1055 Process Injection
Defense Evasion
T1105 Ingress Tool Transfer
Command and Control