{"id":"CVE-2023-46141","aliases":["EUVD-2023-50384","GHSA-c4vw-934c-jc76"],"status":"published","title":"Phoenix Contact: Automation Worx and classic line controllers prone to Incorrect Permission Assignment for Critical Resource","description":"Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full access of the affected device.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00879,"percentile":0.59325,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-732"],"published":"2023-12-14T14:05:11Z","modified":"2026-06-17T06:30:14Z","products":[{"vendor":"phoenix contact","product":"automation worx software suite"},{"vendor":"phoenix contact","product":"axc 1050"},{"vendor":"phoenix contact","product":"axc 1050 xc"},{"vendor":"phoenix contact","product":"axc 3050"},{"vendor":"phoenix contact","product":"config+"},{"vendor":"phoenix contact","product":"fc 350 pci eth"},{"vendor":"phoenix contact","product":"ilc 3xx"},{"vendor":"phoenix contact","product":"ilc1x0"},{"vendor":"phoenix contact","product":"ilc1x1"},{"vendor":"phoenix contact","product":"pc worx"},{"vendor":"phoenix contact","product":"pc worx express"},{"vendor":"phoenix contact","product":"pc worx rt basic"},{"vendor":"phoenix contact","product":"pc worx srt"},{"vendor":"phoenix contact","product":"rfc 430 eth-ib"},{"vendor":"phoenix contact","product":"rfc 450 eth-ib"},{"vendor":"phoenix contact","product":"rfc 460r pn 3tx"},{"vendor":"phoenix contact","product":"rfc 470s pn 3tx"},{"vendor":"phoenix contact","product":"rfc 480s pn 4tx"},{"vendor":"phoenixcontact","product":"automationworx_software_suite"},{"vendor":"phoenixcontact","product":"axc_1050_firmware"},{"vendor":"phoenixcontact","product":"axc_1050_xc_firmware"},{"vendor":"phoenixcontact","product":"axc_3050_firmware"},{"vendor":"phoenixcontact","product":"config\\+"},{"vendor":"phoenixcontact","product":"fc_350_pci_eth_firmware"},{"vendor":"phoenixcontact","product":"ilc1x0_firmware"},{"vendor":"phoenixcontact","product":"ilc1x1_firmware"},{"vendor":"phoenixcontact","product":"ilc_3xx_firmware"},{"vendor":"phoenixcontact","product":"pc_worx"},{"vendor":"phoenixcontact","product":"pc_worx_express"},{"vendor":"phoenixcontact","product":"pc_worx_rt_basic_firmware"},{"vendor":"phoenixcontact","product":"pc_worx_srt"},{"vendor":"phoenixcontact","product":"rfc_430_eth-ib_firmware"},{"vendor":"phoenixcontact","product":"rfc_450_eth-ib_firmware"},{"vendor":"phoenixcontact","product":"rfc_460r_pn_3tx_firmware"},{"vendor":"phoenixcontact","product":"rfc_470s_pn_3tx_firmware"},{"vendor":"phoenixcontact","product":"rfc_480s_pn_4tx_firmware"}],"references":[{"url":"https://cert.vde.com/en/advisories/VDE-2023-055/","tags":["x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46141"},{"url":"https://github.com/advisories/GHSA-c4vw-934c-jc76"}],"sources":{"cve":[{"id":"CVE-2023-46141","title":"Phoenix Contact: Automation Worx and classic line controllers prone to Incorrect Permission Assignment for Critical Resource","description":"Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full access of the affected device.","status":"published","published":"2023-12-14T14:05:11.292Z","modified":"2024-08-02T20:37:39.537Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:35:23.309349Z"}],"euvd":[{"id":"EUVD-2023-50384","description":"Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full access of the affected device.","status":"published","published":"2023-12-14T14:05:11Z","modified":"2024-08-02T20:37:39Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T03:49:58.369276Z"}],"ghsa":[{"id":"GHSA-c4vw-934c-jc76","title":"Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the...","description":"Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full access of the affected device.","status":"published","published":"2023-12-14T15:30:22Z","modified":"2023-12-14T15:30:29Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:55:11.957073Z"}],"nvd":[{"id":"CVE-2023-46141","description":"Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full access of the affected device.","status":"published","published":"2023-12-14T14:15:42.767Z","modified":"2026-06-17T06:30:14.26Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:08:54.696438Z"}]}}