First published: Mon Jun 24 2019(Updated: )
An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86. A manipulated PC Worx or Config+ project file could lead to a Use-After-Free and remote code execution. The attacker needs to get access to an original PC Worx or Config+ project file to be able to manipulate it. After manipulation, the attacker needs to exchange the original file with the manipulated one on the application programming workstation.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
Phoenixcontact Automationworx Software Suite | <=1.86 | |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2019-12871 is a vulnerability that allows remote attackers to execute arbitrary code on vulnerable installations of Phoenix Contact Automationworx.
To exploit this vulnerability, user interaction is required where the target must visit a malicious page or open a malicious file.
The affected software is Phoenix Contact Automationworx versions up to and including 1.86.
The severity of CVE-2019-12871 is high, with a CVSS score of 8.8.
Yes, you can find more information about CVE-2019-12871 at the following references: 1. [VDE-2019-014](https://cert.vde.com/en-us/advisories/vde-2019-014) 2. [ZDI-19-578](https://www.zerodayinitiative.com/advisories/ZDI-19-578/)