CVE-2023-46142

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A incorrect permission assignment for critical resource vulnerability in PLCnext products allows an remote attacker with low privileges to gain full access on the affected devices.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

VendorProductVersions
PHOENIX CONTACTAXC F 1152<= 2024.0
PHOENIX CONTACTAXC F 2152<= 2024.0
PHOENIX CONTACTAXC F 3152<= 2024.0
PHOENIX CONTACTBPC 9102S<= 2024.0
PHOENIX CONTACTEPC 1502<= 2024.0
PHOENIX CONTACTEPC 1522<= 2024.0
PHOENIX CONTACTPLCnext Engineer<= 2024.0
PHOENIX CONTACTRFC 4072R<= 2024.0
PHOENIX CONTACTRFC 4072S<= 2024.0

References

Timeline

Published
Dec 14, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-461437.5Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modCVE-2023-461446.5A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with low privileges to compromise intCVE-2023-461458.8Improper Privilege Management vulnerability in Themify Themify Ultra allows Privilege Escalation.This issue affects Themify Ultra: from n/a CVE-2023-461468.8Missing Authorization vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.CVE-2023-461478.8Deserialization of Untrusted Data vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.CVE-2023-461488.8Missing Authorization vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.CVE-2023-461498.8Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.CVE-2023-46157.5This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication iCVE-2023-461508.8Cross-Site Request Forgery (CSRF) vulnerability in WP Military WP Radio plugin <= 3.1.9 versions.CVE-2023-461518.8Cross-Site Request Forgery (CSRF) vulnerability in AWESOME TOGI Product Category Tree plugin <= 2.5 versions.CVE-2023-461528.8Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.7.1 CVE-2023-461536.1Unauth. Stored Cross-Site Scripting (XSS) vulnerability in UserFeedback Team User Feedback plugin <= 1.0.9 versions.
CVE-2023-46142: High severity, CVSS 8.8 | Vulnix