{
    "document": {
        "category": "csaf_security_advisory",
        "csaf_version": "2.0",
        "tracking": {
            "generator": {
                "date": "2025-04-07T09:30:09.591Z",
                "engine": {
                    "version": "2.5.22",
                    "name": "Secvisogram"
                }
            },
            "current_release_date": "2025-05-14T13:00:15.000Z",
            "id": "VDE-2023-003",
            "initial_release_date": "2023-03-14T09:14:00.000Z",
            "version": "2",
            "status": "final",
            "revision_history": [
                {
                    "number": "1",
                    "date": "2023-03-14T09:14:00.000Z",
                    "summary": "Initial revision."
                },
                {
                    "number": "2",
                    "summary": "Fix: added distribution",
                    "date": "2025-05-14T13:00:15.000Z"
                }
            ],
            "aliases": [
                "VDE-2023-003"
            ]
        },
        "title": "PHOENIX CONTACT: Multiple vulnerabilities in ENERGY AXC PU",
        "lang": "en-GB",
        "acknowledgments": [
            {
                "organization": "CERT@VDE",
                "summary": "coordination"
            }
        ],
        "notes": [
            {
                "category": "summary",
                "text": "Multiple vulnerabilities have been discovered in CODESYS Control V3 runtime system.\nFor details regarding the single vulnerabilities please refer to the security advisories issued by CODESYS:\n\n- CODESYS Security Advisory 2022-02 \n- CODESYS Security Advisory 2022-04\n- CODESYS Security Advisory 2022-06\n- CODESYS Security Advisory 2022-09",
                "title": "Summary"
            },
            {
                "category": "description",
                "text": "The CODESYS Control runtime system enables embedded or PC-based devices to be a programmable industrial controller. Such products contain communication servers for the CODESYS protocol to enable communication with clients.",
                "title": "Impact"
            },
            {
                "category": "description",
                "text": "Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to Phoenix Contacts application note.Measures to protect network-capable devices with Ethernet connection",
                "title": "Mitigation"
            },
            {
                "category": "description",
                "text": "Phoenix Contact strongly recommends updating to the latest firmware mentioned in the list of affected products, which fixes this vulnerability.",
                "title": "Remediation"
            }
        ],
        "publisher": {
            "contact_details": "psirt@phoenixcontact.com",
            "category": "vendor",
            "name": "Phoenix Contact GmbH & Co. KG",
            "namespace": "https://phoenixcontact.com/psirt"
        },
        "references": [
            {
                "summary": "PHOENIX CONTACT PSIRT ",
                "url": "https://phoenixcontact.com/psirt",
                "category": "external"
            },
            {
                "summary": "CERT@VDE Security Advisories for PHOENIX CONTACT",
                "url": "https://certvde.com/en/advisories/vendor/phoenixcontact/",
                "category": "external"
            },
            {
                "summary": "VDE-2023-003: PHOENIX CONTACT: Multiple vulnerabilities in ENERGY AXC PU - HTML",
                "url": "https://certvde.com/en/advisories/VDE-2023-003/",
                "category": "self"
            },
            {
                "url": "https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2023/vde-2023-003.json",
                "summary": "VDE-2023-003: PHOENIX CONTACT: Multiple vulnerabilities in ENERGY AXC PU - CSAF",
                "category": "self"
            }
        ],
        "distribution": {
            "tlp": {
                "label": "WHITE",
                "url": "https://www.first.org/tlp/"
            }
        }
    },
    "product_tree": {
        "branches": [
            {
                "name": "Phoenix Contact",
                "category": "vendor",
                "branches": [
                    {
                        "name": "Hardware",
                        "category": "product_family",
                        "branches": [
                            {
                                "name": "ENERGY AXC PU",
                                "category": "product_name",
                                "product": {
                                    "name": "ENERGY AXC PU",
                                    "product_id": "CSAFPID-11001",
                                    "product_identification_helper": {
                                        "model_numbers": [
                                            "1264327"
                                        ]
                                    }
                                }
                            }
                        ]
                    },
                    {
                        "name": "Firmware",
                        "category": "product_family",
                        "branches": [
                            {
                                "name": "<V04.15.00.00",
                                "category": "product_version_range",
                                "product": {
                                    "name": "Firmware <V04.15.00.00",
                                    "product_id": "CSAFPID-21001"
                                }
                            }
                        ]
                    }
                ]
            }
        ],
        "relationships": [
            {
                "product_reference": "CSAFPID-21001",
                "relates_to_product_reference": "CSAFPID-11001",
                "category": "installed_on",
                "full_product_name": {
                    "name": "Firmware <V04.15.00.00 installed on ENERGY AXC PU",
                    "product_id": "CSAFPID-31001"
                }
            }
        ]
    },
    "vulnerabilities": [
        {
            "cve": "CVE-2022-30792",
            "cwe": {
                "id": "CWE-400",
                "name": "Uncontrolled Resource Consumption"
            },
            "notes": [
                {
                    "category": "description",
                    "text": "In CmpChannelServer of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new communication channel connections. Existing connections are not affected.",
                    "title": "Vulnerability Description"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-31001"
                ]
            },
            "remediations": [
                {
                    "category": "mitigation",
                    "details": "Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to Phoenix Contacts application note.Measures to protect network-capable devices with Ethernet connection",
                    "product_ids": [
                        "CSAFPID-31001"
                    ]
                },
                {
                    "category": "vendor_fix",
                    "details": "Phoenix Contact strongly recommends updating to the latest firmware mentioned in the list of affected products, which fixes this vulnerability.",
                    "product_ids": [
                        "CSAFPID-31001"
                    ]
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "attackComplexity": "LOW",
                        "attackVector": "NETWORK",
                        "availabilityImpact": "HIGH",
                        "baseScore": 7.5,
                        "baseSeverity": "HIGH",
                        "confidentialityImpact": "NONE",
                        "environmentalScore": 7.5,
                        "environmentalSeverity": "HIGH",
                        "integrityImpact": "NONE",
                        "privilegesRequired": "NONE",
                        "scope": "UNCHANGED",
                        "temporalScore": 7.5,
                        "temporalSeverity": "HIGH",
                        "userInteraction": "NONE",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                        "version": "3.1"
                    },
                    "products": [
                        "CSAFPID-31001"
                    ]
                }
            ],
            "title": "CVE-2022-30792"
        },
        {
            "cve": "CVE-2022-22515",
            "cwe": {
                "id": "CWE-668",
                "name": "Exposure of Resource to Wrong Sphere"
            },
            "notes": [
                {
                    "category": "description",
                    "text": "A remote, authenticated attacker could utilize the control program of the CODESYS Control runtime system to use the vulnerability in order to read and modify the configuration file(s) of the affected products.",
                    "title": "Vulnerability Description"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-31001"
                ]
            },
            "remediations": [
                {
                    "category": "mitigation",
                    "details": "Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to Phoenix Contacts application note.Measures to protect network-capable devices with Ethernet connection",
                    "product_ids": [
                        "CSAFPID-31001"
                    ]
                },
                {
                    "category": "vendor_fix",
                    "details": "Phoenix Contact strongly recommends updating to the latest firmware mentioned in the list of affected products, which fixes this vulnerability.",
                    "product_ids": [
                        "CSAFPID-31001"
                    ]
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "attackComplexity": "LOW",
                        "attackVector": "NETWORK",
                        "availabilityImpact": "NONE",
                        "baseScore": 8.1,
                        "baseSeverity": "HIGH",
                        "confidentialityImpact": "HIGH",
                        "environmentalScore": 8.1,
                        "environmentalSeverity": "HIGH",
                        "integrityImpact": "HIGH",
                        "privilegesRequired": "LOW",
                        "scope": "UNCHANGED",
                        "temporalScore": 8.1,
                        "temporalSeverity": "HIGH",
                        "userInteraction": "NONE",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                        "version": "3.1"
                    },
                    "products": [
                        "CSAFPID-31001"
                    ]
                }
            ],
            "title": "CVE-2022-22515"
        },
        {
            "cve": "CVE-2022-22514",
            "cwe": {
                "id": "CWE-822",
                "name": "Untrusted Pointer Dereference"
            },
            "notes": [
                {
                    "category": "description",
                    "text": "An authenticated, remote attacker can gain access to a dereferenced pointer contained in a request. The accesses can subsequently lead to local overwriting of memory in the CmpTraceMgr, whereby the attacker can neither gain the values read internally nor control the values to be written. If invalid memory is accessed, this results in a crash.",
                    "title": "Vulnerability Description"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-31001"
                ]
            },
            "remediations": [
                {
                    "category": "mitigation",
                    "details": "Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to Phoenix Contacts application note.Measures to protect network-capable devices with Ethernet connection",
                    "product_ids": [
                        "CSAFPID-31001"
                    ]
                },
                {
                    "category": "vendor_fix",
                    "details": "Phoenix Contact strongly recommends updating to the latest firmware mentioned in the list of affected products, which fixes this vulnerability.",
                    "product_ids": [
                        "CSAFPID-31001"
                    ]
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "attackComplexity": "LOW",
                        "attackVector": "NETWORK",
                        "availabilityImpact": "HIGH",
                        "baseScore": 7.1,
                        "baseSeverity": "HIGH",
                        "confidentialityImpact": "NONE",
                        "environmentalScore": 7.1,
                        "environmentalSeverity": "HIGH",
                        "integrityImpact": "LOW",
                        "privilegesRequired": "LOW",
                        "scope": "UNCHANGED",
                        "temporalScore": 7.1,
                        "temporalSeverity": "HIGH",
                        "userInteraction": "NONE",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
                        "version": "3.1"
                    },
                    "products": [
                        "CSAFPID-31001"
                    ]
                }
            ],
            "title": "CVE-2022-22514"
        },
        {
            "cve": "CVE-2022-22513",
            "cwe": {
                "id": "CWE-476",
                "name": "NULL Pointer Dereference"
            },
            "notes": [
                {
                    "category": "description",
                    "text": "An authenticated remote attacker can cause a null pointer dereference in the CmpSettings component of the affected CODESYS products which leads to a crash.",
                    "title": "Vulnerability Description"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-31001"
                ]
            },
            "remediations": [
                {
                    "category": "mitigation",
                    "details": "Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to Phoenix Contacts application note.Measures to protect network-capable devices with Ethernet connection",
                    "product_ids": [
                        "CSAFPID-31001"
                    ]
                },
                {
                    "category": "vendor_fix",
                    "details": "Phoenix Contact strongly recommends updating to the latest firmware mentioned in the list of affected products, which fixes this vulnerability.",
                    "product_ids": [
                        "CSAFPID-31001"
                    ]
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "attackComplexity": "LOW",
                        "attackVector": "NETWORK",
                        "availabilityImpact": "HIGH",
                        "baseScore": 6.5,
                        "baseSeverity": "MEDIUM",
                        "confidentialityImpact": "NONE",
                        "environmentalScore": 6.5,
                        "environmentalSeverity": "MEDIUM",
                        "integrityImpact": "NONE",
                        "privilegesRequired": "LOW",
                        "scope": "UNCHANGED",
                        "temporalScore": 6.5,
                        "temporalSeverity": "MEDIUM",
                        "userInteraction": "NONE",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                        "version": "3.1"
                    },
                    "products": [
                        "CSAFPID-31001"
                    ]
                }
            ],
            "title": "CVE-2022-22513"
        },
        {
            "cve": "CVE-2022-22517",
            "cwe": {
                "id": "CWE-330",
                "name": "Use of Insufficiently Random Values"
            },
            "notes": [
                {
                    "category": "description",
                    "text": "An unauthenticated, remote attacker can disrupt existing communication channels between CODESYS products by guessing a valid channel ID and injecting packets. This results in the communication channel to be closed.",
                    "title": "Vulnerability Description"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-31001"
                ]
            },
            "remediations": [
                {
                    "category": "mitigation",
                    "details": "Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to Phoenix Contacts application note.Measures to protect network-capable devices with Ethernet connection",
                    "product_ids": [
                        "CSAFPID-31001"
                    ]
                },
                {
                    "category": "vendor_fix",
                    "details": "Phoenix Contact strongly recommends updating to the latest firmware mentioned in the list of affected products, which fixes this vulnerability.",
                    "product_ids": [
                        "CSAFPID-31001"
                    ]
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "attackComplexity": "LOW",
                        "attackVector": "NETWORK",
                        "availabilityImpact": "HIGH",
                        "baseScore": 7.5,
                        "baseSeverity": "HIGH",
                        "confidentialityImpact": "NONE",
                        "environmentalScore": 7.5,
                        "environmentalSeverity": "HIGH",
                        "integrityImpact": "NONE",
                        "privilegesRequired": "NONE",
                        "scope": "UNCHANGED",
                        "temporalScore": 7.5,
                        "temporalSeverity": "HIGH",
                        "userInteraction": "NONE",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                        "version": "3.1"
                    },
                    "products": [
                        "CSAFPID-31001"
                    ]
                }
            ],
            "title": "CVE-2022-22517"
        }
    ]
}