Vulnerability in Phoenix Contact Automation Worx Software Suite
CVE-2021-33542
Phoenix Contact Classic Automation Worx Software Suite in Version 1.87 and below is affected by a remote code execution vulnerability. Manipulated PC Worx or Config+ projects could lead to a remote code execution when unallocated memory is freed because of incompletely initialized data. The attacker needs to get access to an original bus configuration file (*.bcp) to be able to manipulate data inside. After manipulation the attacker needs to exchange the original file by the manipulated one on the application programming workstation. Availability, integrity, or confidentiality of an application programming workstation might be compromised by attacks using these vulnerabilities. Automated systems in operation which were programmed with one of the above-mentioned products are not affected.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.018 (77.0th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 77th percentile — 77.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.018 · newest: 0.018 · change: 0.000
Affected products
- Phoenix Contact Automation Worx Software Suite — versions PC Worx, PC Worx Express, Config+
- Phoenixcontact Config\+
- Phoenixcontact Pc Worx
- Phoenixcontact Pc Worx Express
Weakness classification (CWE)
References
- cert.vde.com/en-us/advisories/vde-2021-020 (Third Party Advisory)
- www.zerodayinitiative.com/advisories/ZDI-21-782/ (VDB Entry, Third Party Advisory)
Frequently asked questions
- What is CVE-2021-33542?
- CVE-2021-33542 is a high-severity vulnerability in Phoenix Contact Automation Worx Software Suite, classified under Access of Uninitialized Pointer. CVSS score: 7.8/10. Published 2021-06-25.
- How severe is CVE-2021-33542?
- High severity. CVSS v3 base score is 7.8 out of 10.