{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "tracking": { "generator": { "date": "2024-11-11T11:48:33.579Z", "engine": { "version": "2.5.14", "name": "Secvisogram" } }, "current_release_date": "2025-05-14T12:28:19.000Z", "id": "VDE-2020-023", "initial_release_date": "2020-07-01T08:25:00.000Z", "status": "final", "version": "2", "revision_history": [ { "summary": "Initial revision.", "number": "1", "date": "2020-07-01T08:25:00.000Z" }, { "number": "2", "summary": "Fix: version space, added distribution", "date": "2025-05-14T12:28:19.000Z" } ], "aliases": [ "VDE-2020-023" ] }, "lang": "en-GB", "title": "PHOENIX CONTACT: Two Vulnerabilities in Automation Worx Suite", "acknowledgments": [ { "summary": "coordination", "organization": "CERT@VDE" }, { "organization": "Trend Micro Zero Day Initiative", "summary": "discovered", "names": [ "Natnael Samson", "mdm" ] } ], "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "notes": [ { "category": "summary", "title": "Summary", "text": "Manipulated PC Worx projects could lead to a remote code execution due to insufficient input\ndata validation.\n\nThe attacker needs to get access to an original PC Worx project to be able to manipulate data\ninside the project folder. After manipulation the attacker needs to exchange the original files by\nthe manipulated ones on the application programming workstation." }, { "title": "Impact", "category": "description", "text": "Availability, integrity, or confidentiality of an application programming workstation might be compromised by attacks using these vulnerabilities.\nAutomated systems in operation which were programmed with one of the above-mentioned products are not affected." }, { "title": "Mitigation", "category": "description", "text": "We strongly recommend customers to exchange project files only using secure file exchange services. Project files should not be exchanged via unencrypted email.\nIn addition, we recommend exchanging or storing project files together with a checksum to ensure their integrity." }, { "title": "Remediation", "category": "description", "text": "With the next version of Automation Worx Software Suite a sharpened input data validation with respect to buffer size and description of size and number of objects referenced in a file will be implemented." } ], "publisher": { "category": "vendor", "name": "Phoenix Contact GmbH & Co. KG", "contact_details": "psirt@phoenixcontact.com", "namespace": "https://phoenixcontact.com/psirt" }, "references": [ { "summary": "CERT@VDE Security Advisories for Phoenix Contact", "url": "https://certvde.com/en/advisories/vendor/phoenixcontact/", "category": "external" }, { "summary": "VDE-2020-023: PHOENIX CONTACT: Two Vulnerabilities in Automation Worx Suite - HTML", "url": "https://certvde.com/de/advisories/VDE-2020-023/", "category": "self" }, { "summary": "VDE-2020-023: PHOENIX CONTACT: Two Vulnerabilities in Automation Worx Suite - CSAF", "url": "https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2020/vde-2020-023.json", "category": "self" } ] }, "product_tree": { "branches": [ { "name": "PHOENIX CONTACT", "category": "vendor", "branches": [ { "name": "Software", "category": "product_family", "branches": [ { "name": "PC Worx", "category": "product_name", "branches": [ { "name": "<=1.87", "category": "product_version_range", "product": { "name": "Software PC Worx <=1.87", "product_id": "CSAFPID-51001" } } ] }, { "name": "PC Worx Express", "category": "product_name", "branches": [ { "name": "<=1.87", "category": "product_version_range", "product": { "name": "Software PC Worx Express <=1.87", "product_id": "CSAFPID-51002" } } ] } ] } ] } ], "product_groups": [ { "group_id": "CSAFGID-0001", "summary": "Affected products.", "product_ids": [ "CSAFPID-51001", "CSAFPID-51002" ] } ] }, "vulnerabilities": [ { "cve": "CVE-2020-12497", "title": "CVE-2020-12497", "cwe": { "id": "CWE-121", "name": "Stack-based Buffer Overflow" }, "notes": [ { "category": "description", "title": "Description", "text": "PLCopen XML file parsing in Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier can lead to a stack-based overflow. Manipulated PC Worx projects could lead to a remote code execution due to insufficient input data validation." } ], "product_status": { "known_affected": [ "CSAFPID-51001", "CSAFPID-51002" ] }, "remediations": [ { "category": "mitigation", "details": "We strongly recommend customers to exchange project files only using secure file exchange services. Project files should not be exchanged via unencrypted email.\nIn addition, we recommend exchanging or storing project files together with a checksum to ensure their integrity.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "With the next version of Automation Worx Software Suite a sharpened input data validation with respect to buffer size and description of size and number of objects referenced in a file will be implemented.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "temporalScore": 7.8, "temporalSeverity": "HIGH", "environmentalScore": 7.8, "environmentalSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH" }, "products": [ "CSAFPID-51001", "CSAFPID-51002" ] } ] }, { "cve": "CVE-2020-12498", "title": "CVE-2020-12498", "cwe": { "id": "CWE-121", "name": "Stack-based Buffer Overflow" }, "notes": [ { "category": "description", "title": "Description", "text": "mwe file parsing in Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier is vulnerable to out-of-bounds read remote code execution. Manipulated PC Worx projects could lead to a remote code execution due to insufficient input data validation." } ], "product_status": { "known_affected": [ "CSAFPID-51001", "CSAFPID-51002" ] }, "remediations": [ { "category": "mitigation", "details": "We strongly recommend customers to exchange project files only using secure file exchange services. Project files should not be exchanged via unencrypted email.\nIn addition, we recommend exchanging or storing project files together with a checksum to ensure their integrity.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "With the next version of Automation Worx Software Suite a sharpened input data validation with respect to buffer size and description of size and number of objects referenced in a file will be implemented.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "temporalScore": 7.8, "temporalSeverity": "HIGH", "environmentalScore": 7.8, "environmentalSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH" }, "products": [ "CSAFPID-51001", "CSAFPID-51002" ] } ] } ] }