Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware

Act NowCVSS 9.8VDE-2024-073Dec 9, 2024

Phoenix ContactManufacturing

Attack path

Attack VectorNetwork

Auth RequiredNone

ComplexityLow

User InteractionNone needed

Summary

Multiple Linux component vulnerabilities exist in Phoenix Contact PLCnext Firmware across AXC F, RFC, BPC, and EPC series controllers. These vulnerabilities allow remote code execution, unauthorized access to sensitive data, and denial of service attacks on affected devices. Vulnerabilities stem from buffer overflows, path traversal, improper input validation, and insecure cryptographic implementations within embedded Linux components. All affected products can be patched with latest firmware releases (2024.0.6 LTS for most models, 2024.0.3 LTS for EPC series).

What this means

What could happen

An attacker with network access to a vulnerable PLCnext controller could execute arbitrary code, steal sensitive data, or completely disrupt manufacturing operations by taking control of the industrial automation device.

Who's at risk

Manufacturing plants using Phoenix Contact PLCnext controllers (AXC F series, RFC, BPC, EPC models) for process automation, motion control, or safety-critical operations need immediate patching. This includes discrete manufacturing facilities, continuous process plants, and facilities using PLCnext as primary programmable logic controllers.

How it could be exploited

An attacker on the same network or with remote access to the PLCnext controller's Ethernet port could send malicious network packets or exploit multiple Linux component vulnerabilities to execute code with controller privileges. Once code execution is achieved, the attacker could modify process logic, disable safety interlocks, alter production parameters, or halt operations entirely.

Prerequisites

Network access to the PLCnext controller Ethernet port (port 443 or other exposed services)
No authentication required for exploitation
Affected firmware version running on the device

Remotely exploitableNo authentication requiredLow complexityActively exploited (KEV)Critical CVSS 9.8EPSS score 94.4% (very likely to be exploited)Affects core automation platformMultiple critical vulnerabilities in single firmware

Exploitability

Actively exploited — confirmed by CISA KEV

Metasploit module available — weaponized exploitView module ↗

Public Proof-of-Concept (PoC) on GitHub (10 repositories)

Affected products (8)

8 with fix

ProductAffected VersionsFix Status

AXC F 1152<2024.0.6 LTS2024.0.6 LTS

AXC F 2152<2024.0.6 LTS2024.0.6 LTS

AXC F 3152<2024.0.6 LTS2024.0.6 LTS

RFC 4072S<2024.0.6 LTS2024.0.6 LTS

BPC 9102S<2024.0.6 LTS2024.0.6 LTS

RFC 4072R<2024.0.6 LTS2024.0.6 LTS

EPC 1502<2024.0.3 LTS2024.0.3 LTS

EPC 1522<2024.0.3 LTS2024.0.3 LTS

Remediation & Mitigation

0/5

Do now

0/3

AXC F 1152

HOTFIXUpdate AXC F 1152, AXC F 2152, AXC F 3152, RFC 4072S, RFC 4072R, and BPC 9102S controllers to firmware version 2024.0.6 LTS or later

EPC 1502

HOTFIXUpdate EPC 1502 and EPC 1522 controllers to firmware version 2024.0.3 LTS or later

All products

HARDENINGRestrict network access to PLCnext controllers by implementing firewall rules to limit connections from trusted engineering workstations and supervisory systems only

Schedule — requires maintenance window

0/2

Patching may require device reboot — plan for process interruption

HARDENINGIsolate PLCnext controllers on a dedicated industrial control network segment separate from general IT networks and the Internet

HOTFIXUpdate PLCnext Engineer engineering software to the latest version on all workstations used to program or monitor controllers

CVEs (63)

CVE-2023-46219 CVE-2023-38545 CVE-2023-34969 CVE-2022-42011 CVE-2022-48554 CVE-2023-32636 CVE-2023-32611 CVE-2023-32665 CVE-2023-4911 CVE-2024-0567 CVE-2023-32731 CVE-2023-4785 CVE-2023-2603 CVE-2023-6004 CVE-2023-26552 CVE-2023-26554 CVE-2022-29900 CVE-2023-48795 CVE-2023-51385 CVE-2023-5363 CVE-2022-40897 CVE-2023-4016 CVE-2021-41072 CVE-2023-5441 CVE-2023-5535 CVE-2023-4734 CVE-2023-4733 CVE-2023-4735 CVE-2023-4738 CVE-2023-4751 CVE-2023-48237 CVE-2023-46246 CVE-2023-45853 CVE-2023-47100 CVE-2023-46218 CVE-2023-4807 CVE-2023-38039 CVE-2023-38546 CVE-2022-42010 CVE-2022-42012 CVE-2023-29499 CVE-2023-32643 CVE-2023-5156 CVE-2024-0553 CVE-2023-33953 CVE-2023-32732 CVE-2023-44487 CVE-2023-26551 CVE-2023-26553 CVE-2023-26555 CVE-2022-29901 CVE-2023-51384 CVE-2023-3817 CVE-2023-40217 CVE-2023-7104 CVE-2023-42465 CVE-2023-5344 CVE-2023-4781 CVE-2023-4736 CVE-2023-4750 CVE-2023-4752 CVE-2023-48231 CVE-2023-48706

View full CERT@VDE advisory

↑↓ Navigate · Esc Close

API: /api/v1/advisories/fe72774a-36a6-4130-8398-a3fd32251932

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.