{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "tracking": { "generator": { "date": "2025-04-09T08:00:10.688Z", "engine": { "version": "2.5.22", "name": "Secvisogram" } }, "current_release_date": "2025-05-22T13:03:10.000Z", "id": "VDE-2022-025", "initial_release_date": "2022-06-21T05:15:00.000Z", "version": "2", "status": "final", "revision_history": [ { "number": "1", "date": "2022-06-21T05:15:00.000Z", "summary": "Initial revision." }, { "number": "2", "summary": "Fix: added distribution, quotation mark", "date": "2025-05-22T13:03:10.000Z" } ], "aliases": [ "VDE-2022-025" ] }, "title": "PHOENIX CONTACT: Vulnerability in classic line industrial controllers", "lang": "en-GB", "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination" }, { "organization": "Forescout", "summary": "reporting" } ], "notes": [ { "category": "summary", "text": "The affected devices insufficiently verify uploaded data.", "title": "Summary" }, { "category": "description", "text": "An attacker capable of either transmitting manipulated logic or manipulating legitimate logic can execute arbitrary malicious code on the device.", "title": "Impact" }, { "category": "description", "text": "Phoenix Contact classic line controllers are designed and developed for the use in closed industrial networks. The controller doesn't feature logic integrity and authenticity checks by design. Phoenix Contact therefore strongly recommends using the devices exclusively in closed networks and protected by a suitable firewall.\n\nCustomers using Phoenix Contact classic line controllers are recommended to operate the devices in closed networks or protected with a suitable firewall as intended. \n\nGeneric information and recommendations for security measures to protect network-capabledevices can be found in the application note.", "title": "Mitigation" } ], "publisher": { "contact_details": "psirt@phoenixcontact.com", "category": "vendor", "name": "Phoenix Contact GmbH & Co. KG", "namespace": "https://phoenixcontact.com/psirt" }, "references": [ { "summary": "PHOENIX CONTACT PSIRT ", "url": "https://phoenixcontact.com/psirt", "category": "external" }, { "summary": "CERT@VDE Security Advisories for PHOENIX CONTACT", "url": "https://certvde.com/en/advisories/vendor/phoenixcontact/", "category": "external" }, { "summary": "VDE-2022-025: PHOENIX CONTACT: Vulnerability in classic line industrial controllers - HTML", "url": "https://certvde.com/en/advisories/VDE-2022-025/", "category": "self" }, { "url": "https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2022/vde-2022-025.json", "summary": "VDE-2022-025: PHOENIX CONTACT: Vulnerability in classic line industrial controllers - CSAF", "category": "self" } ], "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } } }, "product_tree": { "branches": [ { "name": "Phoenix Contact", "category": "vendor", "branches": [ { "name": "Hardware", "category": "product_family", "branches": [ { "name": "AXC 1050", "category": "product_name", "product": { "name": "AXC 1050", "product_id": "CSAFPID-11001" } }, { "name": "AXC 1050 XC", "category": "product_name", "product": { "name": "AXC 1050 XC", "product_id": "CSAFPID-11002", "product_identification_helper": { "model_numbers": [ "2701295" ] } } }, { "name": "AXC 3050", "category": "product_name", "product": { "name": "AXC 3050", "product_id": "CSAFPID-11003", "product_identification_helper": { "model_numbers": [ "2700989" ] } } }, { "name": "FC 350 PCI ETH", "category": "product_name", "product": { "name": "FC 350 PCI ETH", "product_id": "CSAFPID-11004", "product_identification_helper": { "model_numbers": [ "2730844" ] } } }, { "name": "ILC1x0", "category": "product_name", "product": { "name": "ILC1x0", "product_id": "CSAFPID-11005" } }, { "name": "ILC1x1", "category": "product_name", "product": { "name": "ILC1x1", "product_id": "CSAFPID-11006" } }, { "name": "ILC 1x1 GSM/GPRS", "category": "product_name", "product": { "name": "ILC 1x1 GSM/GPRS", "product_id": "CSAFPID-11007", "product_identification_helper": { "model_numbers": [ "2700977" ] } } }, { "name": "ILC 3xx", "category": "product_name", "product": { "name": "ILC 3xx", "product_id": "CSAFPID-11008" } }, { "name": "PC WORX RT BASIC", "category": "product_name", "product": { "name": "PC WORX RT BASIC", "product_id": "CSAFPID-11009", "product_identification_helper": { "model_numbers": [ "2700291" ] } } }, { "name": "PC WORX SRT", "category": "product_name", "product": { "name": "PC WORX SRT", "product_id": "CSAFPID-11010", "product_identification_helper": { "model_numbers": [ "2701680" ] } } }, { "name": "RFC 430 ETH-IB", "category": "product_name", "product": { "name": "RFC 430 ETH-IB", "product_id": "CSAFPID-11011", "product_identification_helper": { "model_numbers": [ "2730190" ] } } }, { "name": "RFC 450 ETH-IB", "category": "product_name", "product": { "name": "RFC 450 ETH-IB", "product_id": "CSAFPID-11012", "product_identification_helper": { "model_numbers": [ "2730200" ] } } }, { "name": "RFC 460R PN 3TX", "category": "product_name", "product": { "name": "RFC 460R PN 3TX", "product_id": "CSAFPID-11013", "product_identification_helper": { "model_numbers": [ "2700784" ] } } }, { "name": "RFC 460R PN 3TX-S", "category": "product_name", "product": { "name": "RFC 460R PN 3TX-S", "product_id": "CSAFPID-11014", "product_identification_helper": { "model_numbers": [ "1096407" ] } } }, { "name": "RFC 470 PN 3TX", "category": "product_name", "product": { "name": "RFC 470 PN 3TX", "product_id": "CSAFPID-11015", "product_identification_helper": { "model_numbers": [ "2916600" ] } } }, { "name": "RFC 470S PN 3TX", "category": "product_name", "product": { "name": "RFC 470S PN 3TX", "product_id": "CSAFPID-11016", "product_identification_helper": { "model_numbers": [ "2916794" ] } } }, { "name": "RFC 480S PN 4TX", "category": "product_name", "product": { "name": "RFC 480S PN 4TX", "product_id": "CSAFPID-11017", "product_identification_helper": { "model_numbers": [ "2404577" ] } } } ] }, { "name": "Firmware", "category": "product_family", "branches": [ { "name": "vers:all/*", "category": "product_version_range", "product": { "name": "Firmware vers:all/*", "product_id": "CSAFPID-21001" } } ] } ] } ], "product_groups": [ { "group_id": "CSAFGID-0001", "summary": "Affected Products", "product_ids": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017" ] } ], "relationships": [ { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11001", "category": "installed_on", "full_product_name": { "name": "Firmware vers:all/* installed on AXC 1050", "product_id": "CSAFPID-31001" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11002", "category": "installed_on", "full_product_name": { "name": "Firmware vers:all/* installed on AXC 1050 XC", "product_id": "CSAFPID-31002" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11003", "category": "installed_on", "full_product_name": { "name": "Firmware vers:all/* installed on AXC 3050", "product_id": "CSAFPID-31003" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11004", "category": "installed_on", "full_product_name": { "name": "Firmware vers:all/* installed on FC 350 PCI ETH", "product_id": "CSAFPID-31004" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11005", "category": "installed_on", "full_product_name": { "name": "Firmware vers:all/* installed on ILC1x0", "product_id": "CSAFPID-31005" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11006", "category": "installed_on", "full_product_name": { "name": "Firmware vers:all/* installed on ILC1x1", "product_id": "CSAFPID-31006" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11007", "category": "installed_on", "full_product_name": { "name": "Firmware vers:all/* installed on ILC 1x1 GSM/GPRS", "product_id": "CSAFPID-31007" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11008", "category": "installed_on", "full_product_name": { "name": "Firmware vers:all/* installed on ILC 3xx", "product_id": "CSAFPID-31008" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11009", "category": "installed_on", "full_product_name": { "name": "Firmware vers:all/* installed on PC WORX RT BASIC", "product_id": "CSAFPID-31009" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11010", "category": "installed_on", "full_product_name": { "name": "Firmware vers:all/* installed on PC WORX SRT", "product_id": "CSAFPID-31010" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11011", "category": "installed_on", "full_product_name": { "name": "Firmware vers:all/* installed on RFC 430 ETH-IB", "product_id": "CSAFPID-31011" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11012", "category": "installed_on", "full_product_name": { "name": "Firmware vers:all/* installed on RFC 450 ETH-IB", "product_id": "CSAFPID-31012" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11013", "category": "installed_on", "full_product_name": { "name": "Firmware vers:all/* installed on RFC 460R PN 3TX", "product_id": "CSAFPID-31013" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11014", "category": "installed_on", "full_product_name": { "name": "Firmware vers:all/* installed on RFC 460R PN 3TX-S", "product_id": "CSAFPID-31014" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11015", "category": "installed_on", "full_product_name": { "name": "Firmware vers:all/* installed on RFC 470 PN 3TX", "product_id": "CSAFPID-31015" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11016", "category": "installed_on", "full_product_name": { "name": "Firmware vers:all/* installed on RFC 470S PN 3TX", "product_id": "CSAFPID-31016" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11017", "category": "installed_on", "full_product_name": { "name": "Firmware vers:all/* installed on RFC 480S PN 4TX", "product_id": "CSAFPID-31017" } } ] }, "vulnerabilities": [ { "cve": "CVE-2022-31800", "title": "CVE-2022-31800", "cwe": { "id": "CWE-345", "name": "Insufficient Verification of Data Authenticity" }, "notes": [ { "category": "description", "text": "An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017" ] }, "remediations": [ { "category": "mitigation", "details": "Phoenix Contact classic line controllers are designed and developed for the use in closed industrial networks. The controller doesn't feature logic integrity and authenticity checks by design. Phoenix Contact therefore strongly recommends using the devices exclusively in closed networks and protected by a suitable firewall.\n\nCustomers using Phoenix Contact classic line controllers are recommended to operate the devices in closed networks or protected with a suitable firewall as intended.\n\nGeneric information and recommendations for security measures to protect network-capable\ndevices can be found in the application note.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017" ] } ] } ] }