2023-12-14 15:00:31 +00:00
{
"id" : "CVE-2023-46144" ,
"sourceIdentifier" : "info@cert.vde.com" ,
"published" : "2023-12-14T14:15:43.447" ,
2024-12-08 03:06:42 +00:00
"lastModified" : "2024-11-21T08:27:58.380" ,
2024-10-01 08:03:18 +00:00
"vulnStatus" : "Modified" ,
2024-07-14 02:06:08 +00:00
"cveTags" : [ ] ,
2023-12-14 15:00:31 +00:00
"descriptions" : [
{
"lang" : "en" ,
"value" : "A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with low privileges to compromise integrity on the affected engineering station and the connected devices."
2023-12-21 19:00:28 +00:00
} ,
{
"lang" : "es" ,
"value" : "Una descarga de c\u00f3digo sin vulnerabilidad de verificaci\u00f3n de integridad en los productos PLCnext permite que un atacante remoto con privilegios bajos comprometa la integridad de la estaci\u00f3n de ingenier\u00eda afectada y los dispositivos conectados."
2023-12-14 15:00:31 +00:00
}
] ,
"metrics" : {
"cvssMetricV31" : [
2023-12-21 19:00:28 +00:00
{
2024-10-01 08:03:18 +00:00
"source" : "info@cert.vde.com" ,
2023-12-21 19:00:28 +00:00
"type" : "Primary" ,
"cvssData" : {
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" ,
2024-12-08 03:06:42 +00:00
"baseScore" : 6.5 ,
"baseSeverity" : "MEDIUM" ,
2023-12-21 19:00:28 +00:00
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"privilegesRequired" : "LOW" ,
"userInteraction" : "NONE" ,
"scope" : "UNCHANGED" ,
"confidentialityImpact" : "NONE" ,
"integrityImpact" : "HIGH" ,
2024-12-08 03:06:42 +00:00
"availabilityImpact" : "NONE"
2023-12-21 19:00:28 +00:00
} ,
"exploitabilityScore" : 2.8 ,
"impactScore" : 3.6
} ,
2023-12-14 15:00:31 +00:00
{
2024-10-01 08:03:18 +00:00
"source" : "nvd@nist.gov" ,
2023-12-14 15:00:31 +00:00
"type" : "Secondary" ,
"cvssData" : {
"version" : "3.1" ,
2024-10-01 08:03:18 +00:00
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" ,
2024-12-08 03:06:42 +00:00
"baseScore" : 6.5 ,
"baseSeverity" : "MEDIUM" ,
2023-12-14 15:00:31 +00:00
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"privilegesRequired" : "LOW" ,
"userInteraction" : "NONE" ,
2024-10-01 08:03:18 +00:00
"scope" : "UNCHANGED" ,
2023-12-14 15:00:31 +00:00
"confidentialityImpact" : "NONE" ,
"integrityImpact" : "HIGH" ,
2024-12-08 03:06:42 +00:00
"availabilityImpact" : "NONE"
2023-12-14 15:00:31 +00:00
} ,
2024-10-01 08:03:18 +00:00
"exploitabilityScore" : 2.8 ,
"impactScore" : 3.6
2023-12-14 15:00:31 +00:00
}
]
} ,
"weaknesses" : [
{
"source" : "info@cert.vde.com" ,
2024-12-15 03:03:56 +00:00
"type" : "Primary" ,
2023-12-14 15:00:31 +00:00
"description" : [
{
"lang" : "en" ,
"value" : "CWE-494"
}
]
}
] ,
2023-12-21 19:00:28 +00:00
"configurations" : [
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:phoenixcontact:axc_f_1152_firmware:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "2024.0" ,
"matchCriteriaId" : "9C72F7B2-43D1-43CB-B611-B57487E9AE53"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:phoenixcontact:axc_f_1152:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "A2474BD7-C447-4E07-A628-C729E376943D"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:phoenixcontact:axc_f_2152_firmware:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "2024.0" ,
"matchCriteriaId" : "4EA16E9E-ADBB-4943-AE2D-7C49F882A809"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:phoenixcontact:axc_f_2152:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "AE2E6118-6587-444A-A143-9C3A1E6ED4FD"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:phoenixcontact:axc_f_3152_firmware:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "2024.0" ,
"matchCriteriaId" : "E28DCF3B-C26E-44BE-BCA1-0AED56326FC3"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:phoenixcontact:axc_f_3152:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "57424998-4EAB-4682-BFC4-1D2A621514F4"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:phoenixcontact:bpc_9102s_firmware:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "2024.0" ,
"matchCriteriaId" : "A97B1250-2830-4EFC-9393-DF96E129E16D"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:phoenixcontact:bpc_9102s:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "346E85EB-8800-40C7-A7DA-EA587CF90F08"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:phoenixcontact:epc_1502_firmware:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "2024.0" ,
"matchCriteriaId" : "F8E7E962-9BA0-418B-8A43-541C5278C9ED"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:phoenixcontact:epc_1502:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "85AF0A71-02C4-4CFF-A820-5C326F066024"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:phoenixcontact:epc_1522_firmware:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "2024.0" ,
"matchCriteriaId" : "E3671BE8-A1DE-444E-9A24-5C86E4F0BBF1"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:phoenixcontact:epc_1522:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "CBD531B6-09DA-4B4A-AA7C-C2A54B089C67"
}
]
}
]
} ,
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:phoenixcontact:plcnext_engineer:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "2024.0" ,
"matchCriteriaId" : "C6A5C5E9-4F2C-44BC-8B64-29D25C789643"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:phoenixcontact:rfc_4072r_firmware:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "2024.0" ,
"matchCriteriaId" : "FE1D89DD-1717-4E84-8A33-82AA29594E7D"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:phoenixcontact:rfc_4072r:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "65D9C540-F273-4EA8-8FF6-95DF46B01D89"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:phoenixcontact:rfc_4072s_firmware:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "2024.0" ,
"matchCriteriaId" : "E633B5AB-BD27-461D-8083-20CC1C768D34"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:phoenixcontact:rfc_4072s:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "0BF1EAD1-7C19-4A6E-BF87-EF3F7E526BD6"
}
]
}
]
}
] ,
2023-12-14 15:00:31 +00:00
"references" : [
{
"url" : "https://https://cert.vde.com/en/advisories/VDE-2023-056/" ,
2023-12-21 19:00:28 +00:00
"source" : "info@cert.vde.com" ,
"tags" : [
"Broken Link"
]
2024-12-08 03:06:42 +00:00
} ,
{
"url" : "https://https://cert.vde.com/en/advisories/VDE-2023-056/" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Broken Link"
]
2023-12-14 15:00:31 +00:00
}
]
}
