CVE-2022-31800 — Insufficient Verification of Data Authenticity in Contact AXC 1050

CWE-345 — Insufficient Verification of Data Authenticity3 documents3 sources
Severity
9.8CRITICALNVD
EPSS
1.6%
top 18.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
17
Phoenix Contact AXC 1050Phoenix Contact AXC 1050 XCPhoenix Contact AXC 3050+14 more
Timeline
PublishedJun 21
Latest updateJun 22

Description

An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages17 packages

▶CVEListV5phoenix_contact/ilc_1x0All Versions
▶CVEListV5phoenix_contact/ilc_1x1All Versions
▶CVEListV5phoenix_contact/ilc_3xxAll Versions
▶CVEListV5phoenix_contact/axc_1050All Versions
▶CVEListV5phoenix_contact/axc_3050All Versions

🔴Vulnerability Details

2
GHSA
GHSA-m7x4-j34m-52hc: An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the dev↗2022-06-22
▶
CVEList
Insufficient Verification of Data Vulnerability in PHOENIX CONTACT classic line industrial controllers↗2022-06-21
▶
CVE-2022-31800 — Phoenix Contact AXC 1050 vulnerability | cvebase