Skip to content
Fencer Vulns
critical 9.8

CVE-2022-31800 json

Insufficient Verification of Data Vulnerability in PHOENIX CONTACT classic line industrial controllers

published 2022-06-21 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-53189

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.6%
EPSS 1.6% chance of exploitation in 30 days, percentile 75%
public exploits
0
none known

Summary

An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-22-172-03 updated cvss 9.8

Phoenix Contact Classic Line Controllers

  • Phoenix Contact AXC 1050 2700988 Phoenix Contact AXC 1050 XC 2701295 Phoenix Contact AXC 3050 2700989 Phoenix Contact FC 350 PCI ETH 2730844 Phoenix Contact ILC 1x0 Phoenix Contact ILC 1x1
    +11 more products
    Phoenix Contact ILC 1x1 GSM/GPRS 2700977 Phoenix Contact ILC 3xx Phoenix Contact PC WORX RT BASIC 2700291 Phoenix Contact PC WORX SRT 2701680 Phoenix Contact RFC 430 ETH-IB 2730190 Phoenix Contact RFC 450 ETH-IB 2730200 Phoenix Contact RFC 460R PN 3TX 2700784 Phoenix Contact RFC 460R PN 3TX-S 1096407 Phoenix Contact RFC 470 PN 3TX 2916600 Phoenix Contact RFC 470S PN 3TX 2916794 Phoenix Contact RFC 480S PN 4TX 2404577
    affected: mitigation “Connections between the engineering tools and the controller must always be in a locally protected environment or protected by VPN for remote access.” dam-mdc.phoenixcontact.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
5 mo ago

Exploit prediction

1.57% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • cert.vde.com https://cert.vde.com/en/advisories/VDE-2022-025/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • PHOENIX CONTACT ILC 1x0
  • PHOENIX CONTACT ILC 1x1
  • PHOENIX CONTACT ILC 1x1 GSM/GPRS
  • PHOENIX CONTACT ILC 3xx
  • PHOENIX CONTACT AXC 1050
  • PHOENIX CONTACT AXC 1050 XC
  • PHOENIX CONTACT AXC 3050
  • PHOENIX CONTACT RFC 480S PN 4TX
  • PHOENIX CONTACT RFC 470 PN 3TX
  • PHOENIX CONTACT RFC 470S PN 3TX
  • PHOENIX CONTACT RFC 460R PN 3TX
  • PHOENIX CONTACT RFC 460R PN 3TX-S
  • PHOENIX CONTACT RFC 430 ETH-IB
  • PHOENIX CONTACT RFC 450 ETH-IB
  • PHOENIX CONTACT PC WORX SRT
  • PHOENIX CONTACT PC WORX RT BASIC
  • PHOENIX CONTACT FC 350 PCI ETH

Classification

Weakness
  • CWE-345 Insufficient Verification of Data Authenticity

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.