Phoenix Contact: Classic line industrial controllers prone to inadequate integrity check of PLC

published 2023-12-14 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-50386

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 26%
public exploits: 0; none known

Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all applications on a PLC.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-26-279-06 updated 2026-10-06 cvss 7.5

Hitachi Energy RTU500

Hitachi Energy RTU500 series CMU Firmware vers:RTU500_series_CMU_Firmware/<=11.x
affected: fixed in 12.7.8

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 17 mo ago (2025-05-22)

Exploit prediction

0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

PHOENIX CONTACT Automation Worx Software Suite
PHOENIX CONTACT AXC 1050
PHOENIX CONTACT AXC 1050 XC
PHOENIX CONTACT AXC 3050
PHOENIX CONTACT Config+
PHOENIX CONTACT FC 350 PCI ETH
PHOENIX CONTACT ILC1x0
PHOENIX CONTACT ILC1x1
PHOENIX CONTACT ILC 3xx
PHOENIX CONTACT PC Worx
PHOENIX CONTACT PC Worx Express
PHOENIX CONTACT PC WORX RT BASIC
PHOENIX CONTACT PC WORX SRT
PHOENIX CONTACT RFC 430 ETH-IB
PHOENIX CONTACT RFC 450 ETH-IB
PHOENIX CONTACT RFC 460R PN 3TX
PHOENIX CONTACT RFC 470S PN 3TX
PHOENIX CONTACT RFC 480S PN 4TX

Classification

Weakness

CWE-494 Download of Code Without Integrity Check

References

cert.vde.com /en/advisories/VDE-2023-057/
third-party-advisory

Sources

CVE List CVE-2023-46143
NVD CVE-2023-46143

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary