Vulnerabilities > CVE-2020-12497 - Out-of-bounds Write vulnerability in Phoenixcontact PC Worx and PC Worx Express

CVSS 7.8 - HIGH

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

local

low complexity

phoenixcontact

CWE-787

NVD

Published: 2020-07-01

Updated: 2023-01-28

Summary

PLCopen XML file parsing in Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier can lead to a stack-based overflow. Manipulated PC Worx projects could lead to a remote code execution due to insufficient input data validation.

Vulnerable Configurations

Part	Description	Count
Application	Phoenixcontact Phoenixcontact PC Worx - Phoenixcontact PC Worx 1.10 Phoenixcontact PC Worx 1.20 Phoenixcontact PC Worx 1.23 Phoenixcontact PC Worx 1.30 Phoenixcontact PC Worx 1.40 Phoenixcontact PC Worx 1.50 Phoenixcontact PC Worx 1.60 Phoenixcontact PC Worx 1.70 Phoenixcontact PC Worx 1.80 Phoenixcontact PC Worx 1.81 Phoenixcontact PC Worx 1.82 Phoenixcontact PC Worx 1.83 Phoenixcontact PC Worx 1.84 Phoenixcontact PC Worx 1.85 Phoenixcontact PC Worx 1.86 Phoenixcontact PC Worx Express - Phoenixcontact PC Worx Express 1.10 Phoenixcontact PC Worx Express 1.20 Phoenixcontact PC Worx Express 1.23 Phoenixcontact PC Worx Express 1.30 Phoenixcontact PC Worx Express 1.40 Phoenixcontact PC Worx Express 1.50 Phoenixcontact PC Worx Express 1.60 Phoenixcontact PC Worx Express 1.70 Phoenixcontact PC Worx Express 1.80 Phoenixcontact PC Worx Express 1.81 Phoenixcontact PC Worx Express 1.82 Phoenixcontact PC Worx Express 1.83 Phoenixcontact PC Worx Express 1.84 Phoenixcontact PC Worx Express 1.85 Phoenixcontact PC Worx Express 1.86 Phoenixcontact PC Worx Express 1.87	91

Common Weakness Enumeration (CWE)

CWE-787 - Out-of-bounds Write

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References