CVE-2023-46141 Missing authorization in AXC 1050

Critical 9.8 Published 14 Dec 2023 Updated 2 Aug 2024

Remote unauthenticated attackers can gain full access to Phoenix Contact classic line controllers due to incorrect permission assignments.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-46141?

CVE-2023-46141 is a critical missing authorization vulnerability in PHOENIX CONTACT AXC 1050, published on 14 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full access of the affected device.

Weakness: CWE-732

Which versions are affected by CVE-2023-46141?

It affects 18 products.

Products include Phoenixcontact Automationworx Software Suite, Phoenixcontact Axc 1050 Firmware, Phoenixcontact Axc 1050 Xc Firmware, Phoenixcontact Axc 3050 Firmware, Phoenixcontact Config\+, Phoenixcontact Fc 350 Pci Eth Firmware and 12 more.

How do I fix CVE-2023-46141?

No fix has been published for CVE-2023-46141 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-46141 being exploited?

There is no known exploitation of CVE-2023-46141 in the wild and no public exploit code.

Sources

Also known as GHSA-c4vw-934c-jc76.