Description
An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86. A manipulated PC Worx or Config+ project file could lead to an Out-of-bounds Read and remote code execution. The attacker needs to get access to an original PC Worx or Config+ project to be able to manipulate data inside. After manipulation, the attacker needs to exchange the original files with the manipulated ones on the application programming workstation.
References (4)
Core 4
Core References
Third Party Advisory x_refsource_misc
https://cert.vde.com/en-us/advisories
Third Party Advisory, VDB Entry x_refsource_misc
https://www.zerodayinitiative.com/advisories/ZDI-19-922/
Third Party Advisory, US Government Resource x_refsource_misc
https://www.us-cert.gov/ics/advisories/icsa-19-302-01
Third Party Advisory x_refsource_misc
https://www.zerodayinitiative.com/advisories/ZDI-19-991/
Scores
CVSS v3
7.8
EPSS
0.0700
EPSS Percentile
91.5%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Details
CWE
CWE-125
Status
published
Products (3)
phoenixcontact/config\+
< 1.86
phoenixcontact/pc_worx
< 1.86
phoenixcontact/pc_worx_express
< 1.86
Published
Oct 31, 2019
Tracked Since
Feb 18, 2026