Phoenixcontact Config+ vulnerabilities

4 CVEs affecting Phoenixcontact Config+, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-46143, published 2023-12-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-16675, published 2019-10-31. High severity, CVSS 7.8. EPSS: 3.3% chance of exploitation in the next 30 days. An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86. A manipulated PC Worx or Config+ project file could lead to an Out-of-bounds…
CVE-2021-33542, published 2021-06-25. High severity, CVSS 7.0. EPSS: 1.8% chance of exploitation in the next 30 days. Phoenix Contact Classic Automation Worx Software Suite in Version 1.87 and below is affected by a remote code execution vulnerability. Manipulated PC Worx or Config+ projects could lead to a remote…
CVE-2023-46141, published 2023-12-14. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full access of the…
CVE-2023-46143, published 2023-12-14. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all applications on a PLC.