CVE-2019-16675
mediumPriorität · verfolgen · 32EPSS 0.033 · 88. PerzentilDEEUUSEPSS · bewertet 2026-10-27
An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86. A manipulated PC Worx or Config+ project file could lead to an Out-of-bounds Read and remote code execution. The attacker needs to get access to an original PC Worx or Config+ project to be able to manipulate data inside. After manipulation, the attacker needs to exchange the original files with the manipulated ones on the application programming workstation.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- Behobenphoenix_contact_psirt
With the next version of Automationworx Software Suite a sharpened validation of arrays regarding dimension and number of elements during input data conversion will be implemented. To improve the robustness against manipulated project files the input data validation will be extended. Further preventive security measures will be activated in the compiler settings.
- Mitigationphoenix_contact_psirt
We strongly recommend customers to exchange project files only using secure file exchange services. Project files should not be exchanged via unencrypted email.
- MitigationConfig+cisa_csaf_ot
Phoenix Contact is in the process of developing an updated version of this product. Prior to receiving the updated version, Phoenix Contact strongly recommends users exchange project files using only secure file exchange services, and that project files should not be exchanged via unencrypted email. Phoenix Contact expects the next version of the Automation Worx Suite to be available prior to the end of 2019, noting the upcoming release of Automation Worx Software Suite will have a more robust validation of arrays regarding dimension and the number of elements allowed during input data conversion. In addition, input data validation will be extended in order to strengthen defenses against manipulated project files. Additional preventative security measures will be enabled for the compiler settings as well.
- MitigationPC Worxcisa_csaf_ot
Phoenix Contact is in the process of developing an updated version of this product. Prior to receiving the updated version, Phoenix Contact strongly recommends users exchange project files using only secure file exchange services, and that project files should not be exchanged via unencrypted email. Phoenix Contact expects the next version of the Automation Worx Suite to be available prior to the end of 2019, noting the upcoming release of Automation Worx Software Suite will have a more robust validation of arrays regarding dimension and the number of elements allowed during input data conversion. In addition, input data validation will be extended in order to strengthen defenses against manipulated project files. Additional preventative security measures will be enabled for the compiler settings as well.
- MitigationPC Worx Expresscisa_csaf_ot
Phoenix Contact is in the process of developing an updated version of this product. Prior to receiving the updated version, Phoenix Contact strongly recommends users exchange project files using only secure file exchange services, and that project files should not be exchanged via unencrypted email. Phoenix Contact expects the next version of the Automation Worx Suite to be available prior to the end of 2019, noting the upcoming release of Automation Worx Software Suite will have a more robust validation of arrays regarding dimension and the number of elements allowed during input data conversion. In addition, input data validation will be extended in order to strengthen defenses against manipulated project files. Additional preventative security measures will be enabled for the compiler settings as well.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.8–7.8
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (16)
Betroffene Produkte und Versionsbereiche.
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- VDE-2019-016PHOENIX CONTACT: Security Advisory for Automation Worx Software Suite2019-10-15csaf · phoenix_contact_psirtDE
Manipulated PC Worx or Config+ projects could lead to a remote code execution due to insufficient input data validation. The attacker needs to get access to an original PC Worx or Config+ project to be able to manipulate data inside the project folder. After manipulation the attacker needs to exchange the original files by the manipulated ones on the application programming workstation.
- ICSA-19-302-01PHOENIX CONTACT Automation Worx Software Suite2019-10-29icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could compromise the availability, integrity, or confidentiality of an application programming workstation. Automated systems programmed using one of the affected products are not impacted.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (15)
Externe Belege — Patches, Meldungen, Analysen.
- https://cert.vde.com/en-us/advisoriescnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2019-16675cnnvd
- https://www.auscert.org.au/bulletins/ESB-2019.4007/cnnvd
- https://www.us-cert.gov/ics/advisories/icsa-19-302-01cnnvd
- https://www.zerodayinitiative.com/advisories/ZDI-19-922/cnnvd
- https://www.zerodayinitiative.com/advisories/ZDI-19-923/cnnvd
- https://www.zerodayinitiative.com/advisories/ZDI-19-991/cnnvd
- https://cert.vde.com/en-us/advisoriesenisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan