Skip to content
Fencer Vulns
critical 9.8

CVE-2023-46141 json

Phoenix Contact: Automation Worx and classic line controllers prone to Incorrect Permission Assignment for Critical Resource

published 2023-12-14 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-50384

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits
0
none known

Summary

Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full access of the affected device.

Exploit prediction

0.88% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • PHOENIX CONTACT Automation Worx Software Suite
  • PHOENIX CONTACT AXC 1050
  • PHOENIX CONTACT AXC 1050 XC
  • PHOENIX CONTACT AXC 3050
  • PHOENIX CONTACT Config+
  • PHOENIX CONTACT FC 350 PCI ETH
  • PHOENIX CONTACT ILC1x0
  • PHOENIX CONTACT ILC1x1
  • PHOENIX CONTACT ILC 3xx
  • PHOENIX CONTACT PC Worx
  • PHOENIX CONTACT PC Worx Express
  • PHOENIX CONTACT PC WORX RT BASIC
  • PHOENIX CONTACT PC WORX SRT
  • PHOENIX CONTACT RFC 430 ETH-IB
  • PHOENIX CONTACT RFC 450 ETH-IB
  • PHOENIX CONTACT RFC 460R PN 3TX
  • PHOENIX CONTACT RFC 470S PN 3TX
  • PHOENIX CONTACT RFC 480S PN 4TX

Classification

Weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.