Phoenix Contact: Automation Worx and classic line controllers prone to Incorrect Permission Assignment for Critical Resource

9.8 CVSS

Vulnerability Description

Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full access of the affected device.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-46141

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Reid Wightman of Dragos, Inc.

References

https://cert.vde.com/en/advisories/VDE-2023-055/

More from PHOENIX CONTACT

View All →

CVE-2025-41668

Phoenix Contact: File access due to the replacement of a critical file used by the service security-profile

High 8.8

CVE-2025-41667

Phoenix Contact: File access due to the replacement of a critical file used by the arp-preinit script

High 8.8

CVE-2025-41666

Phoenix Contact: File access due to the replacement of a critical file used by the watchdog

High 8.8

CVE-2025-41665

Phoenix Contact: DoS of the PLC due to incorrect default permissions possible

Medium 6.5

CVE-2024-7734

Phoenix Contact: Multiple mGuard devices are vulnerable to a drain of open file descriptors.

Medium 5.3

Affected Vendor

PHOENIX CONTACT

View all reports →

Affected Software

Automation Worx Software Suite, AXC 1050, AXC 1050 XC, AXC 3050, Config+, FC 350 PCI ETH, ILC1x0, ILC1x1, ILC 3xx, PC Worx, PC Worx Express, PC WORX RT BASIC, PC WORX SRT, RFC 430 ETH-IB, RFC 450 ETH-IB, RFC 460R PN 3TX, RFC 470S PN 3TX, RFC 480S PN 4TX

Vulnerable Versions:

all