CVE-2023-46143 Phoenix Contact: Classic line industrial controllers prone to inadequate integrity check of PLC

High 7.5 Published 14 Dec 2023 Updated 22 May 2025

Unauthenticated remote attackers can modify PLC applications due to inadequate integrity checks, impacting industrial control systems.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-46143?

CVE-2023-46143 is a high-severity code injection vulnerability in PHOENIX CONTACT AXC 1050, published on 14 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all applications on a PLC.

Weakness: CWE-494

Which versions are affected by CVE-2023-46143?

It affects 18 products.

Products include Phoenixcontact Automationworx Software Suite, Phoenixcontact Axc 1050 Firmware, Phoenixcontact Axc 1050 Xc Firmware, Phoenixcontact Axc 3050 Firmware, Phoenixcontact Config\+, Phoenixcontact Fc 350 Pci Eth Firmware and 12 more.

How do I fix CVE-2023-46143?

No fix has been published for CVE-2023-46143 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2023-46143 being exploited?

There is no known exploitation of CVE-2023-46143 in the wild and no public exploit code.

Sources

Also known as GHSA-frfw-grgg-284c.