Out-of-bounds Read in Phoenix Contact Config+
CVE-2022-3737
In PHOENIX CONTACT Automationworx Software Suite up to version 1.89 memory can be read beyond the intended scope due to insufficient validation of input data. Availability, integrity, or confidentiality of an application programming workstation might be compromised by attacks using these vulnerabilities.
Vulnerability class: Buffer Overflow
EPSS: 0.002 (10.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Phoenix Contact Config+ — versions 0
- Phoenix Contact Pc Worx — versions 0
- Phoenix Contact Pc Worx Express — versions 0
- Phoenixcontact Automationworx_software_suite — versions 1.89
Weakness classification (CWE)
References
- info@cert.vde.com (Third Party Advisory)
Frequently asked questions
- What is CVE-2022-3737?
- CVE-2022-3737 is a high-severity vulnerability in Phoenix Contact Config+, classified under Out-of-bounds Read. CVSS score: 7.8/10. Published 2022-11-15.
- How severe is CVE-2022-3737?
- High severity. CVSS v3 base score is 7.8 out of 10.