PHOENIX CONTACT: PC Worx/-Express prone to improper input validation vulnerability

An attacker who crafts a malicious project file and tricks an engineer into opening it in PC Worx could write files anywhere on the engineering workstation, potentially overwriting critical files or inserting malware that persists across system reboots.

This affects any water utility, electric utility, or other industrial facility that uses Phoenix Contact's PC Worx or PC Worx Express software for engineering and maintenance of automation systems. Impact is limited to engineering workstations where project files are edited and loaded; production PLCs and field devices are not directly affected unless malware is injected into a project that is then downloaded to those devices.

An attacker creates a specially crafted project file (ZIP archive) that exploits improper path validation when extracting files. When an engineer opens this file in PC Worx or PC Worx Express, the application extracts the archive contents without properly validating paths, allowing relative paths or directory traversal sequences (e.g., "../../../") to write files outside the intended project directory. The attacker delivers this file via email, file share, or social engineering.