Out-of-bounds Read in Phoenix Contact Config+
CVE-2022-3737
In PHOENIX CONTACT Automationworx Software Suite up to version 1.89 memory can be read beyond the intended scope due to insufficient validation of input data. Availability, integrity, or confidentiality of an application programming workstation might be compromised by attacks using these vulnerabilities.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.002 (10.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 10th percentile — 10.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Phoenix Contact Config+ — versions 0
- Phoenix Contact Pc Worx — versions 0
- Phoenix Contact Pc Worx Express — versions 0
- Phoenixcontact Automationworx Software Suite — versions 1.89
Weakness classification (CWE)
References
- cert.vde.com/en/advisories/VDE-2022-048/ (Third Party Advisory)
Frequently asked questions
- What is CVE-2022-3737?
- CVE-2022-3737 is a high-severity vulnerability in Phoenix Contact Config+, classified under Out-of-bounds Read. CVSS score: 7.8/10. Published 2022-11-15.
- How severe is CVE-2022-3737?
- High severity. CVSS v3 base score is 7.8 out of 10.