Skip to content
Fencer Vulns
high 7.8

CVE-2021-33542 json

Phoenix Contact: Automation Worx Software Suite affected by Remote Code Execution (RCE) vulnerability

published 2021-06-25 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-20234

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.8%
EPSS 1.8% chance of exploitation in 30 days, percentile 78%
public exploits
0
none known

Summary

Phoenix Contact Classic Automation Worx Software Suite in Version 1.87 and below is affected by a remote code execution vulnerability. Manipulated PC Worx or Config+ projects could lead to a remote code execution when unallocated memory is freed because of incompletely initialized data. The attacker needs to get access to an original bus configuration file (*.bcp) to be able to manipulate data inside. After manipulation the attacker needs to exchange the original file by the manipulated one on the application programming workstation. Availability, integrity, or confidentiality of an application programming workstation might be compromised by attacks using these vulnerabilities. Automated systems in operation which were programmed with one of the above-mentioned products are not affected.

Exploit prediction

1.76% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 3.1 7.0 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P

Affected products

  • Phoenix Contact Automation Worx Software Suite

Classification

Weakness
  • CWE-824 Access of Uninitialized Pointer

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.