CVE-2022-31800

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-345

Affected software

VendorProductVersions
PHOENIX CONTACTILC 1x0All Versions
PHOENIX CONTACTILC 1x1All Versions
PHOENIX CONTACTILC 1x1 GSM/GPRSAll Versions
PHOENIX CONTACTILC 3xxAll Versions
PHOENIX CONTACTAXC 1050All Versions
PHOENIX CONTACTAXC 1050 XCAll Versions
PHOENIX CONTACTAXC 3050All Versions
PHOENIX CONTACTRFC 480S PN 4TXAll Versions
PHOENIX CONTACTRFC 470 PN 3TXAll Versions
PHOENIX CONTACTRFC 470S PN 3TXAll Versions
PHOENIX CONTACTRFC 460R PN 3TXAll Versions
PHOENIX CONTACTRFC 460R PN 3TX-SAll Versions
PHOENIX CONTACTRFC 430 ETH-IBAll Versions
PHOENIX CONTACTRFC 450 ETH-IBAll Versions
PHOENIX CONTACTPC WORX SRTAll Versions
PHOENIX CONTACTPC WORX RT BASICAll Versions
PHOENIX CONTACTFC 350 PCI ETHAll Versions

References

Timeline

Published
Jun 21, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-318019.8An unauthenticated, remote attacker could upload malicious logic to the devices based on ProConOS/ProConOS eCLR in order to gain full controCVE-2022-318029.8In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared to the real CODESYS CVE-2022-318035.3In CODESYS Gateway Server V2 an insufficient check for the activity of TCP client connections allows an unauthenticated attacker to consume CVE-2022-318047.5The CODESYS Gateway Server V2 does not verifiy that the size of a request is within expected limits. An unauthenticated attacker may allocatCVE-2022-318057.5In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and CVE-2022-318069.8In CODESYS V2 PLCWinNT and Runtime Toolkit 32 in versions prior to V2.4.7.57 password protection is not enabled by default and there is no iCVE-2022-318075.5A vulnerability has been identified in Building X - Security Manager Edge Controller (ACC-AP) (All versions). Affected devices do not properCVE-2022-318087.8A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V2.85.44), SiPass integrated ACC-AP (All versions <CVE-2022-31817.5An Improper Input Validation vulnerability exists in Trihedral VTScada version 12.0.38 and prior. A specifically malformed HTTP request coulCVE-2022-318107.5A vulnerability has been identified in SiPass integrated (All versions < V2.90.3.8). Affected server applications improperly check the size CVE-2022-318127.5A vulnerability has been identified in SiPass integrated (All versions < V2.95.3.18). Affected server applications contain an out of bounds CVE-2022-318139.8Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop