{"id":"CVE-2023-46143","aliases":["EUVD-2023-50386","GHSA-frfw-grgg-284c"],"status":"published","title":"Phoenix Contact: Classic line industrial controllers prone to inadequate integrity check of PLC","description":"Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all applications on a PLC.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00332,"percentile":0.26692,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-494"],"published":"2023-12-14T14:06:06Z","modified":"2026-06-17T06:30:14Z","products":[{"vendor":"phoenix contact","product":"automation worx software suite"},{"vendor":"phoenix contact","product":"axc 1050"},{"vendor":"phoenix contact","product":"axc 1050 xc"},{"vendor":"phoenix contact","product":"axc 3050"},{"vendor":"phoenix contact","product":"config+"},{"vendor":"phoenix contact","product":"fc 350 pci eth"},{"vendor":"phoenix contact","product":"ilc 3xx"},{"vendor":"phoenix contact","product":"ilc1x0"},{"vendor":"phoenix contact","product":"ilc1x1"},{"vendor":"phoenix contact","product":"pc worx"},{"vendor":"phoenix contact","product":"pc worx express"},{"vendor":"phoenix contact","product":"pc worx rt basic"},{"vendor":"phoenix contact","product":"pc worx srt"},{"vendor":"phoenix contact","product":"rfc 430 eth-ib"},{"vendor":"phoenix contact","product":"rfc 450 eth-ib"},{"vendor":"phoenix contact","product":"rfc 460r pn 3tx"},{"vendor":"phoenix contact","product":"rfc 470s pn 3tx"},{"vendor":"phoenix contact","product":"rfc 480s pn 4tx"},{"vendor":"phoenixcontact","product":"automationworx_software_suite"},{"vendor":"phoenixcontact","product":"axc_1050_firmware"},{"vendor":"phoenixcontact","product":"axc_1050_xc_firmware"},{"vendor":"phoenixcontact","product":"axc_3050_firmware"},{"vendor":"phoenixcontact","product":"config\\+"},{"vendor":"phoenixcontact","product":"fc_350_pci_eth_firmware"},{"vendor":"phoenixcontact","product":"ilc1x0_firmware"},{"vendor":"phoenixcontact","product":"ilc1x1_firmware"},{"vendor":"phoenixcontact","product":"ilc_3xx_firmware"},{"vendor":"phoenixcontact","product":"pc_worx"},{"vendor":"phoenixcontact","product":"pc_worx_express"},{"vendor":"phoenixcontact","product":"pc_worx_rt_basic_firmware"},{"vendor":"phoenixcontact","product":"pc_worx_srt"},{"vendor":"phoenixcontact","product":"rfc_430_eth-ib_firmware"},{"vendor":"phoenixcontact","product":"rfc_450_eth-ib_firmware"},{"vendor":"phoenixcontact","product":"rfc_460r_pn_3tx_firmware"},{"vendor":"phoenixcontact","product":"rfc_470s_pn_3tx_firmware"},{"vendor":"phoenixcontact","product":"rfc_480s_pn_4tx_firmware"}],"references":[{"url":"https://cert.vde.com/en/advisories/VDE-2023-057/","tags":["x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46143"},{"url":"https://github.com/advisories/GHSA-frfw-grgg-284c"}],"sources":{"cve":[{"id":"CVE-2023-46143","title":"Phoenix Contact: Classic line industrial controllers prone to inadequate integrity check of PLC","description":"Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all applications on a PLC.","status":"published","published":"2023-12-14T14:06:06.479Z","modified":"2025-05-22T17:39:45.716Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-494"],"updated_at":"2026-11-02T14:35:23.309349Z"}],"euvd":[{"id":"EUVD-2023-50386","description":"Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all applications on a PLC.","status":"published","published":"2023-12-14T14:06:06Z","modified":"2025-05-22T17:39:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T20:32:40.249574Z"}],"ghsa":[{"id":"GHSA-frfw-grgg-284c","title":"Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs...","description":"Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all applications on a PLC.","status":"published","published":"2023-12-14T15:30:22Z","modified":"2023-12-14T15:30:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-494"],"updated_at":"2026-11-02T14:55:11.957073Z"}],"nvd":[{"id":"CVE-2023-46143","description":"Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all applications on a PLC.","status":"published","published":"2023-12-14T14:15:43.207Z","modified":"2026-06-17T06:30:14.54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-494"],"updated_at":"2026-11-02T14:08:54.696438Z"}]}}