CVE-2019-9201

highpriority · track · 40OT risk · elevatedEPSS 0.031 · 88 %ileDEEURUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
3.10% (88th) EPSS
CVSS 9 · high
Is it mine?
70 products
Check your exposure
Who says so?
5 sources
cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-27

Multiple Phoenix Contact devices allow remote attackers to establish TCP sessions to port 1962 and obtain sensitive information or make changes, as demonstrated by using the Create Backup feature to traverse all directories.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedAXC 1050cisa_csaf_ot

    RFC 480S PN 4TX: Article number 2404577, firmware 6.10

  • FixedAXC 1050XCcisa_csaf_ot

    RFC 480S PN 4TX: Article number 2404577, firmware 6.10

  • FixedAXC 3050cisa_csaf_ot

    RFC 480S PN 4TX: Article number 2404577, firmware 6.10

  • FixedFC 350 PCI ETHcisa_csaf_ot

    RFC 480S PN 4TX: Article number 2404577, firmware 6.10

  • FixedILC 1x0cisa_csaf_ot

    RFC 480S PN 4TX: Article number 2404577, firmware 6.10

  • FixedILC 1x1cisa_csaf_ot

    RFC 480S PN 4TX: Article number 2404577, firmware 6.10

  • FixedILC 3xxcisa_csaf_ot

    RFC 480S PN 4TX: Article number 2404577, firmware 6.10

  • FixedPC WORX RT BASICcisa_csaf_ot

    RFC 480S PN 4TX: Article number 2404577, firmware 6.10

  • FixedPC WORX SRTcisa_csaf_ot

    RFC 480S PN 4TX: Article number 2404577, firmware 6.10

  • FixedRFC 430 ETHcisa_csaf_ot

    RFC 480S PN 4TX: Article number 2404577, firmware 6.10

  • FixedRFC 450 ETHcisa_csaf_ot

    RFC 480S PN 4TX: Article number 2404577, firmware 6.10

  • FixedRFC 460Rcisa_csaf_ot

    RFC 480S PN 4TX: Article number 2404577, firmware 6.10

  • FixedRFC 470Scisa_csaf_ot

    RFC 480S PN 4TX: Article number 2404577, firmware 6.10

  • FixedRFC 480Scisa_csaf_ot

    RFC 480S PN 4TX: Article number 2404577, firmware 6.10

  • Mitigationphoenix_contact_psirt

    Customers using Phoenix Contact classic line controllers are recommended to operate the devices in closed networks or protected with a suitable firewall as intended. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note external link for classic line controllers. If the use of an affected controller in protected zones is not suitable OT communication protocols should be disabled. Either by using the CPU services via console or Web-based Management according to the controller type. Information's for which controllers and from which firmware version communication protocols can be disabled are described in our application note for classic line controllers or the manual to the respective controller which is available for download at the Phoenix Contact website. Controller supporting CPU services or WBM for disabling communication protocols: | Article | Article Number | Minimum firmware version | |----------------------|----------------|----------------------------------| | ILC 1x0 | All variants | not possible | | ILC 1x1 | All variants | >= FW 4.42 | | ILC 1x1 GSM/GPRS | 2700977 | >= FW 4.42 | | ILC 3xx | All variants | FW 3.98 | | AXC 1050 | 2700988 | >= FW 3.01, FW 5.00 (WBM) | | AXC 1050 XC | 2701295 | >= FW 3.01, FW 5.00 (WBM) | | AXC 3050 | 2700989 | >= FW 5.60, FW 6.30 (WBM) | | RFC 480S PN 4TX | 2404577 | FW 6.10 | | RFC 470 PN 3TX | 2916600 | >= FW 4.20 | | RFC 470S PN 3TX | 2916794 | >= FW 4.20 | | RFC 460R PN 3TX | 2700784 | >= FW 5.00 | | RFC 460R PN 3TX-S | 1096407 | FW 5.30 | | RFC 430 ETH-IB | 2730190 | not possible | | RFC 450 ETH-IB | 2730200 | not possible | | PC WORX SRT | 2701680 | not possible | | PC WORX RT BASIC | 2700291 | not possible | | FC 350 PCI ETH | 2730844 | not possible |

  • MitigationAXC 1050cisa_csaf_ot

    AXC 1050: Article number 2700988, firmware 3.01, 5.00 (WBM)

  • MitigationAXC 1050XCcisa_csaf_ot

    AXC 1050: Article number 2700988, firmware 3.01, 5.00 (WBM)

  • MitigationAXC 3050cisa_csaf_ot

    AXC 1050: Article number 2700988, firmware 3.01, 5.00 (WBM)

  • MitigationFC 350 PCI ETHcisa_csaf_ot

    AXC 1050: Article number 2700988, firmware 3.01, 5.00 (WBM)

  • MitigationILC 1x0cisa_csaf_ot

    AXC 1050: Article number 2700988, firmware 3.01, 5.00 (WBM)

  • MitigationILC 1x1cisa_csaf_ot

    AXC 1050: Article number 2700988, firmware 3.01, 5.00 (WBM)

  • MitigationILC 3xxcisa_csaf_ot

    AXC 1050: Article number 2700988, firmware 3.01, 5.00 (WBM)

  • MitigationPC WORX RT BASICcisa_csaf_ot

    AXC 1050: Article number 2700988, firmware 3.01, 5.00 (WBM)

  • MitigationPC WORX SRTcisa_csaf_ot

    AXC 1050: Article number 2700988, firmware 3.01, 5.00 (WBM)

  • MitigationRFC 430 ETHcisa_csaf_ot

    AXC 1050: Article number 2700988, firmware 3.01, 5.00 (WBM)

  • MitigationRFC 450 ETHcisa_csaf_ot

    AXC 1050: Article number 2700988, firmware 3.01, 5.00 (WBM)

  • MitigationRFC 460Rcisa_csaf_ot

    AXC 1050: Article number 2700988, firmware 3.01, 5.00 (WBM)

  • MitigationRFC 470Scisa_csaf_ot

    AXC 1050: Article number 2700988, firmware 3.01, 5.00 (WBM)

  • MitigationRFC 480Scisa_csaf_ot

    AXC 1050: Article number 2700988, firmware 3.01, 5.00 (WBM)

02

cvss

Technical severity, 0–10. One row per scoring source.

9.8
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 9–9.8

v2.09highAV:N/AC:L/Au:N/C:P/I:P/A:Cprimary · NVD / NIST USexploitability 10 · impact 8.5
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9
v3.09.8criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US
v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · cve@mitre.org USexploitability 3.9 · impact 5.9
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Phoenix Contact PSIRT DE
v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-306USprimaryCWE-287USCWE-306USCWE-306US
05

affected products (70)

Products and version ranges known to be affected.

showing 20 of 70
06

advisories (2)

Vendor and ecosystem advisories describing this.

  • VDE-2019-015PHOENIX CONTACT: Security Advisory for multiple Industrial Controllers2019-08-07csaf · phoenix_contact_psirtDE

    Phoenix Contact Classic Line industrial controllers (ILC1x0 and ILC1x1 product families as well as the AXIOLINE controllers AXC1050 and AXC3050) are developed and designed for the use in closed industrial networks. The communication protocols used for device management and configuration do not feature authentication measures. Update A, 2022-06-21 This updated version contains additional affected products.In addition, a new application note for classic line controllers had been published to make it easier for our customers to find out the actions how to disable the unauthorized communication ports instead of checking out each controller's manual.

  • ICSA-22-172-05Phoenix Contact Classic Line Industrial Controllers2022-06-21icsa · cisa_csaf_otUS

    Successful exploitation of this vulnerability could allow an unauthorized attacker to change configurations, manipulate services, or cause a denial-of-service condition.

07

also known as (5)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bducisa_csaf_otphoenix_contact_psirtNVDCVE.orgMITRE
published 2019-02-26modified 2026-06-17
10

references (9)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan