{"document":{"acknowledgments":[{"organization":"CERT@VDE","summary":"coordination"},{"organization":"Forescout","summary":"re-discovered"},{"organization":"Sergiu Sechel","summary":"reported"}],"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en-GB","notes":[{"category":"summary","text":"Phoenix Contact Classic Line industrial controllers (ILC1x0 and ILC1x1 product families as well as the AXIOLINE controllers AXC1050 and AXC3050) are developed and designed for the use in closed industrial networks. The communication protocols used for device management and configuration do not feature authentication measures.\n\n**Update A, 2022-06-21**\n\nThis updated version contains additional affected products.\nIn addition, a new application note for classic line controllers had been published to make it easier for our customers to find out the actions how to disable the unauthorized communication ports instead of checking out each controller’s manual.","title":"Summary"},{"category":"description","text":"If the above-mentioned controllers are used in an unprotected open network, an unauthorized attacker can change or download the device code/configuration, start or stop services, update or modify the firmware or shutdown the device.","title":"Impact"},{"category":"description","text":"Customers using Phoenix Contact classic line controllers are recommended to operate the devices in closed networks or protected with a suitable firewall as intended.\n\nFor detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note (https://dam-mdc.phoenixcontact.com/asset/156443151564/74777de2d270be4cb4828ee57173dbd0/Application-note_110637_en_00.pdf) for classic line controllers.\n\nIf the use of an affected controller in protected zones is not suitable OT communication protocols should be disabled. Either by using the CPU services via console or Web-based Management according to the controller type.\nInformation’s for which controllers and from which firmware version communication protocols can be disabled are described in our application note for classic line controllers or the manual to the respective controller which is available for download at the Phoenix Contact website.\n\nController supporting CPU services or WBM for disabling communication protocols:\n\n| Article              | Article Number | Minimum firmware version         |\n|----------------------|----------------|----------------------------------|\n| ILC 1x0              | All variants   | not possible                     |\n| ILC 1x1              | All variants   | >= FW 4.42                       |\n| ILC 1x1 GSM/GPRS     | 2700977        | >= FW 4.42                       |\n| ILC 3xx              | All variants   | FW 3.98                          |\n| AXC 1050             | 2700988        | >= FW 3.01, FW 5.00 (WBM)        |\n| AXC 1050 XC          | 2701295        | >= FW 3.01, FW 5.00 (WBM)        |\n| AXC 3050             | 2700989        | >= FW 5.60, FW 6.30 (WBM)        |\n| RFC 480S PN 4TX      | 2404577        | FW 6.10                          |\n| RFC 470 PN 3TX       | 2916600        | >= FW 4.20                       |\n| RFC 470S PN 3TX      | 2916794        | >= FW 4.20                       |\n| RFC 460R PN 3TX      | 2700784        | >= FW 5.00                       |\n| RFC 460R PN 3TX-S    | 1096407        | FW 5.30                          |\n| RFC 430 ETH-IB       | 2730190        | not possible                     |\n| RFC 450 ETH-IB       | 2730200        | not possible                     |\n| PC WORX SRT          | 2701680        | not possible                     |\n| PC WORX RT BASIC     | 2700291        | not possible                     |\n| FC 350 PCI ETH       | 2730844        | not possible                     |","title":"Mitigation"}],"publisher":{"category":"vendor","contact_details":"psirt@phoenixcontact.com","name":"Phoenix Contact GmbH & Co. KG","namespace":"https://phoenixcontact.com/psirt"},"references":[{"category":"external","summary":"CERT@VDE Security Advisories for \tPHOENIX CONTACT","url":"https://certvde.com/en/advisories/vendor/phoenixcontact/"},{"category":"self","summary":"VDE-2019-015: PHOENIX CONTACT: Security Advisory for multiple Industrial Controllers - HTML","url":"https://certvde.com/de/advisories/VDE-2019-015/"},{"category":"self","summary":"VDE-2019-015: PHOENIX CONTACT: Security Advisory for multiple Industrial Controllers - CSAF","url":"https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2019/vde-2019-015.json"}],"title":"PHOENIX CONTACT: Security Advisory for multiple Industrial Controllers","tracking":{"aliases":["VDE-2019-015"],"current_release_date":"2022-06-21T05:14:00.000Z","generator":{"date":"2024-09-13T07:26:08.963Z","engine":{"name":"Secvisogram","version":"2.5.11"}},"id":"VDE-2019-015","initial_release_date":"2022-06-21T05:14:00.000Z","revision_history":[{"date":"2022-06-21T05:14:00.000Z","number":"1","summary":"Initial revision."},{"date":"2022-06-21T05:14:00.000Z","number":"2","summary":"final version."},{"date":"2024-11-06T11:27:01.000Z","number":"3","summary":"Fix: correct certvde domain, added alias, added self-reference"}],"status":"final","version":"3"}},"product_tree":{"branches":[{"branches":[{"branches":[{"branches":[{"category":"product_name","name":"1050","product":{"name":"AXC 1050","product_id":"CSAFPID-11001","product_identification_helper":{"model_numbers":["2700988"]}}},{"category":"product_name","name":"1050 XC","product":{"name":"PHOENIX CONTACT Hardware AXC 1050 XC","product_id":"CSAFPID-11002","product_identification_helper":{"model_numbers":["2701295"]}}},{"category":"product_name","name":"3050","product":{"name":"PHOENIX CONTACT Hardware AXC 3050","product_id":"CSAFPID-11003","product_identification_helper":{"model_numbers":["2700989"]}}}],"category":"product_family","name":"AXC"},{"branches":[{"category":"product_name","name":"350 PCI ETH","product":{"name":"PHOENIX CONTACT Hardware FC 350 PCI ETH","product_id":"CSAFPID-11004","product_identification_helper":{"model_numbers":["2730844"]}}}],"category":"product_family","name":"FC"},{"branches":[{"category":"product_name","name":"1x0","product":{"name":"PHOENIX CONTACT Hardware ILC 1x0","product_id":"CSAFPID-11005"}},{"category":"product_name","name":"1x1","product":{"name":"PHOENIX CONTACT Hardware ILC 1x1","product_id":"CSAFPID-11006"}},{"category":"product_name","name":"1x1 GSM/GPRS","product":{"name":"PHOENIX CONTACT Hardware ILC 1x1 GSM/GPRS","product_id":"CSAFPID-11007","product_identification_helper":{"model_numbers":["2700977"]}}},{"category":"product_name","name":"3xx","product":{"name":"PHOENIX CONTACT Hardware ILC 3xx","product_id":"CSAFPID-11029"}}],"category":"product_family","name":"ILC"},{"branches":[{"category":"product_name","name":"430 ETH-IB","product":{"name":"PHOENIX CONTACT Hardware RFC 430 ETH-IB","product_id":"CSAFPID-11010","product_identification_helper":{"model_numbers":["2730190"]}}},{"category":"product_name","name":"450 ETH-IB","product":{"name":"PHOENIX CONTACT Hardware RFC 450 ETH-IB","product_id":"CSAFPID-11011","product_identification_helper":{"model_numbers":["2730200"]}}},{"category":"product_name","name":"460R PN 3TX","product":{"name":"PHOENIX CONTACT Hardware RFC 460R PN 3TX","product_id":"CSAFPID-11012","product_identification_helper":{"model_numbers":["2700784"]}}},{"category":"product_name","name":"460R PN 3TX-S","product":{"name":"PHOENIX CONTACT Hardware RFC 460R PN 3TX-S","product_id":"CSAFPID-11013","product_identification_helper":{"model_numbers":["1096407"]}}},{"category":"product_name","name":"470 PN 3TX","product":{"name":"PHOENIX CONTACT Hardware RFC 470 PN 3TX","product_id":"CSAFPID-11014","product_identification_helper":{"model_numbers":["2916600"]}}},{"category":"product_name","name":"470S PN 3TX","product":{"name":"PHOENIX CONTACT Hardware RFC 470S PN 3TX","product_id":"CSAFPID-11015","product_identification_helper":{"model_numbers":["2916794"]}}},{"category":"product_name","name":"480S PN 4TX","product":{"name":"PHOENIX CONTACT Hardware RFC 480S PN 4TX","product_id":"CSAFPID-11016","product_identification_helper":{"model_numbers":["2404577"]}}}],"category":"product_family","name":"RFC"}],"category":"product_family","name":"Hardware"},{"branches":[{"category":"product_version_range","name":">= FW 4.42","product":{"name":"PHOENIX CONTACT Firmware >= FW 4.42","product_id":"CSAFPID-22017"}},{"category":"product_version","name":"FW 3.98","product":{"name":"PHOENIX CONTACT Firmware FW 3.98","product_id":"CSAFPID-22018"}},{"category":"product_version_range","name":">= FW 3.01","product":{"name":"PHOENIX CONTACT Firmware >= FW 3.01","product_id":"CSAFPID-22019"}},{"category":"product_version","name":"FW 5.00 (WBM)","product":{"name":"PHOENIX CONTACT Firmware FW 5.00 (WBM)","product_id":"CSAFPID-22020"}},{"category":"product_version_range","name":">= FW 5.60","product":{"name":"PHOENIX CONTACT Firmware >= FW 5.60","product_id":"CSAFPID-22021"}},{"category":"product_version","name":"FW 6.30 (WBM)","product":{"name":"PHOENIX CONTACT Firmware FW 6.30 (WBM)","product_id":"CSAFPID-22022"}},{"category":"product_version","name":"FW 6.10","product":{"name":"PHOENIX CONTACT Firmware FW 6.10","product_id":"CSAFPID-22023"}},{"category":"product_version_range","name":">= FW 4.20","product":{"name":"PHOENIX CONTACT Firmware >= FW 4.20","product_id":"CSAFPID-22024"}},{"category":"product_version_range","name":">= FW 5.00","product":{"name":"PHOENIX CONTACT Firmware >= FW 5.00","product_id":"CSAFPID-22025"}},{"category":"product_version","name":"FW 5.30","product":{"name":"PHOENIX CONTACT Firmware FW 5.30","product_id":"CSAFPID-22026"}},{"category":"product_version_range","name":"all versions","product":{"name":"PHOENIX CONTACT Firmware all versions","product_id":"CSAFPID-21044"}}],"category":"product_family","name":"Firmware"},{"branches":[{"branches":[{"category":"product_name","name":"RT BASIC","product":{"name":"PHOENIX CONTACT Software PC WORX RT BASIC","product_id":"CSAFPID-11008"}},{"category":"product_name","name":"SRT","product":{"name":"PHOENIX CONTACT Software PC WORX SRT","product_id":"CSAFPID-11009"}}],"category":"product_name","name":"PC WORX"}],"category":"product_family","name":"Software"}],"category":"vendor","name":"PHOENIX CONTACT"}],"product_groups":[{"group_id":"CSAFGID-0001","product_ids":["CSAFPID-31045","CSAFPID-31046","CSAFPID-31047","CSAFPID-31048","CSAFPID-31049","CSAFPID-31050","CSAFPID-31051","CSAFPID-31054","CSAFPID-31055","CSAFPID-31056","CSAFPID-31057","CSAFPID-31058","CSAFPID-31059","CSAFPID-31060"],"summary":"Affected products."}],"relationships":[{"category":"installed_on","full_product_name":{"name":"Firmware >= FW 4.42 installed on Hardware ILC 1x1","product_id":"CSAFPID-32027"},"product_reference":"CSAFPID-22017","relates_to_product_reference":"CSAFPID-11006"},{"category":"installed_on","full_product_name":{"name":"Firmware >= FW 4.42 installed on Hardware ILC 1x1 GSM/GPRS","product_id":"CSAFPID-32028"},"product_reference":"CSAFPID-22017","relates_to_product_reference":"CSAFPID-11007"},{"category":"installed_on","full_product_name":{"name":"Firmware FW 3.98 installed on Hardware ILC 3xx","product_id":"CSAFPID-32030"},"product_reference":"CSAFPID-22018","relates_to_product_reference":"CSAFPID-11029"},{"category":"installed_on","full_product_name":{"name":"Firmware >= FW 3.01 installed on Hardware AXC 1050","product_id":"CSAFPID-32031"},"product_reference":"CSAFPID-22019","relates_to_product_reference":"CSAFPID-11001"},{"category":"installed_on","full_product_name":{"name":"Firmware FW 5.00 (WBM) installed on Hardware AXC 1050","product_id":"CSAFPID-32032"},"product_reference":"CSAFPID-22020","relates_to_product_reference":"CSAFPID-11001"},{"category":"installed_on","full_product_name":{"name":"Firmware >= FW 3.01 installed on Hardware AXC 1050 XC","product_id":"CSAFPID-32033"},"product_reference":"CSAFPID-22019","relates_to_product_reference":"CSAFPID-11002"},{"category":"installed_on","full_product_name":{"name":"Firmware >= FW 3.01 installed on Hardware AXC 1050 XC","product_id":"CSAFPID-32034"},"product_reference":"CSAFPID-22019","relates_to_product_reference":"CSAFPID-11002"},{"category":"installed_on","full_product_name":{"name":"Firmware FW 5.00 (WBM) installed on Hardware AXC 1050 XC","product_id":"CSAFPID-32035"},"product_reference":"CSAFPID-22020","relates_to_product_reference":"CSAFPID-11002"},{"category":"installed_on","full_product_name":{"name":"Firmware >= FW 5.60 installed on Hardware AXC 3050","product_id":"CSAFPID-32036"},"product_reference":"CSAFPID-22021","relates_to_product_reference":"CSAFPID-11003"},{"category":"installed_on","full_product_name":{"name":"Firmware >= FW 5.60 installed on Hardware AXC 3050","product_id":"CSAFPID-32037"},"product_reference":"CSAFPID-22021","relates_to_product_reference":"CSAFPID-11003"},{"category":"installed_on","full_product_name":{"name":"Firmware FW 6.30 (WBM) installed on Hardware AXC 3050","product_id":"CSAFPID-32038"},"product_reference":"CSAFPID-22022","relates_to_product_reference":"CSAFPID-11003"},{"category":"installed_on","full_product_name":{"name":"Firmware FW 6.10 installed on Hardware RFC 480S PN 4TX","product_id":"CSAFPID-32039"},"product_reference":"CSAFPID-22023","relates_to_product_reference":"CSAFPID-11016"},{"category":"installed_on","full_product_name":{"name":"Firmware >= FW 4.20 installed on Hardware RFC 470 PN 3TX","product_id":"CSAFPID-32040"},"product_reference":"CSAFPID-22024","relates_to_product_reference":"CSAFPID-11014"},{"category":"installed_on","full_product_name":{"name":"Firmware >= FW 4.20 installed on Hardware RFC 470S PN 3TX","product_id":"CSAFPID-32041"},"product_reference":"CSAFPID-22024","relates_to_product_reference":"CSAFPID-11015"},{"category":"installed_on","full_product_name":{"name":"Firmware >= FW 5.00 installed on Hardware RFC 460R PN 3TX","product_id":"CSAFPID-32042"},"product_reference":"CSAFPID-22025","relates_to_product_reference":"CSAFPID-11012"},{"category":"installed_on","full_product_name":{"name":"Firmware FW 5.30 installed on Hardware RFC 460R PN 3TX-S","product_id":"CSAFPID-32043"},"product_reference":"CSAFPID-22026","relates_to_product_reference":"CSAFPID-11013"},{"category":"installed_on","full_product_name":{"name":"Firmware all versions installed on Hardware AXC 1050","product_id":"CSAFPID-31045"},"product_reference":"CSAFPID-21044","relates_to_product_reference":"CSAFPID-11001"},{"category":"installed_on","full_product_name":{"name":"Firmware all versions installed on Hardware AXC 1050 XC","product_id":"CSAFPID-31046"},"product_reference":"CSAFPID-21044","relates_to_product_reference":"CSAFPID-11002"},{"category":"installed_on","full_product_name":{"name":"Firmware all versions installed on Hardware AXC 3050","product_id":"CSAFPID-31047"},"product_reference":"CSAFPID-21044","relates_to_product_reference":"CSAFPID-11003"},{"category":"installed_on","full_product_name":{"name":"Firmware all versions installed on Hardware FC 350 PCI ETH","product_id":"CSAFPID-31048"},"product_reference":"CSAFPID-21044","relates_to_product_reference":"CSAFPID-11004"},{"category":"installed_on","full_product_name":{"name":"Firmware all versions installed on Hardware ILC 1x0","product_id":"CSAFPID-31049"},"product_reference":"CSAFPID-21044","relates_to_product_reference":"CSAFPID-11005"},{"category":"installed_on","full_product_name":{"name":"Firmware all versions installed on Hardware ILC 1x1","product_id":"CSAFPID-31050"},"product_reference":"CSAFPID-21044","relates_to_product_reference":"CSAFPID-11006"},{"category":"installed_on","full_product_name":{"name":"Firmware all versions installed on Hardware ILC 1x1 GSM/GPRS","product_id":"CSAFPID-31051"},"product_reference":"CSAFPID-21044","relates_to_product_reference":"CSAFPID-11007"},{"category":"installed_on","full_product_name":{"name":"Firmware all versions installed on Hardware RFC 430 ETH-IB","product_id":"CSAFPID-31054"},"product_reference":"CSAFPID-21044","relates_to_product_reference":"CSAFPID-11010"},{"category":"installed_on","full_product_name":{"name":"Firmware all versions installed on Hardware RFC 450 ETH-IB","product_id":"CSAFPID-31055"},"product_reference":"CSAFPID-21044","relates_to_product_reference":"CSAFPID-11011"},{"category":"installed_on","full_product_name":{"name":"Firmware all versions installed on Hardware RFC 460R PN 3TX","product_id":"CSAFPID-31056"},"product_reference":"CSAFPID-21044","relates_to_product_reference":"CSAFPID-11012"},{"category":"installed_on","full_product_name":{"name":"Firmware all versions installed on Hardware RFC 460R PN 3TX-S","product_id":"CSAFPID-31057"},"product_reference":"CSAFPID-21044","relates_to_product_reference":"CSAFPID-11013"},{"category":"installed_on","full_product_name":{"name":"Firmware all versions installed on Hardware RFC 470 PN 3TX","product_id":"CSAFPID-31058"},"product_reference":"CSAFPID-21044","relates_to_product_reference":"CSAFPID-11014"},{"category":"installed_on","full_product_name":{"name":"Firmware all versions installed on Hardware RFC 470S PN 3TX","product_id":"CSAFPID-31059"},"product_reference":"CSAFPID-21044","relates_to_product_reference":"CSAFPID-11015"},{"category":"installed_on","full_product_name":{"name":"Firmware all versions installed on Hardware RFC 480S PN 4TX","product_id":"CSAFPID-31060"},"product_reference":"CSAFPID-21044","relates_to_product_reference":"CSAFPID-11016"}]},"vulnerabilities":[{"cve":"CVE-2019-9201","cwe":{"id":"CWE-287","name":"Improper Authentication"},"notes":[{"category":"description","text":"Phoenix Contact ILC 131 ETH, ILC 131 ETH/XC, ILC 151 ETH, ILC 151 ETH/XC, ILC 171 ETH 2TX, ILC 191 ETH 2TX, ILC 191 ME/AN, and AXC 1050 devices allow remote attackers to establish TCP sessions to port 1962 and obtain sensitive information or make changes, as demonstrated by using the Create Backup feature to traverse all directories.","title":"Vulnerability Description"}],"product_status":{"known_affected":["CSAFPID-31045","CSAFPID-31046","CSAFPID-31047","CSAFPID-31048","CSAFPID-31049","CSAFPID-31050","CSAFPID-31051","CSAFPID-31054","CSAFPID-31055","CSAFPID-31056","CSAFPID-31057","CSAFPID-31058","CSAFPID-31059","CSAFPID-31060","CSAFPID-11008","CSAFPID-11009"]},"remediations":[{"category":"mitigation","date":"2022-06-21T05:14:00.000Z","details":"Customers using Phoenix Contact classic line controllers are recommended to operate the devices in closed networks or protected with a suitable firewall as intended.\n\nFor detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note (https://dam-mdc.phoenixcontact.com/asset/156443151564/74777de2d270be4cb4828ee57173dbd0/Application-note_110637_en_00.pdf) for classic line controllers.\n\nIf the use of an affected controller in protected zones is not suitable OT communication protocols should be disabled. Either by using the CPU services via console or Web-based Management according to the controller type.\nInformation’s for which controllers and from which firmware version communication protocols can be disabled are described in our application note for classic line controllers or the manual to the respective controller which is available for download at the Phoenix Contact website.\n\nController supporting CPU services or WBM for disabling communication protocols:\n\n| Article              | Article Number | Minimum firmware version         |\n|----------------------|----------------|----------------------------------|\n| ILC 1x0              | All variants   | not possible                     |\n| ILC 1x1              | All variants   | >= FW 4.42                       |\n| ILC 1x1 GSM/GPRS     | 2700977        | >= FW 4.42                       |\n| ILC 3xx              | All variants   | FW 3.98                          |\n| AXC 1050             | 2700988        | >= FW 3.01, FW 5.00 (WBM)        |\n| AXC 1050 XC          | 2701295        | >= FW 3.01, FW 5.00 (WBM)        |\n| AXC 3050             | 2700989        | >= FW 5.60, FW 6.30 (WBM)        |\n| RFC 480S PN 4TX      | 2404577        | FW 6.10                          |\n| RFC 470 PN 3TX       | 2916600        | >= FW 4.20                       |\n| RFC 470S PN 3TX      | 2916794        | >= FW 4.20                       |\n| RFC 460R PN 3TX      | 2700784        | >= FW 5.00                       |\n| RFC 460R PN 3TX-S    | 1096407        | FW 5.30                          |\n| RFC 430 ETH-IB       | 2730190        | not possible                     |\n| RFC 450 ETH-IB       | 2730200        | not possible                     |\n| PC WORX SRT          | 2701680        | not possible                     |\n| PC WORX RT BASIC     | 2700291        | not possible                     |\n| FC 350 PCI ETH       | 2730844        | not possible                     |","group_ids":["CSAFGID-0001"],"product_ids":["CSAFPID-31045","CSAFPID-31046","CSAFPID-31047","CSAFPID-31048","CSAFPID-31049","CSAFPID-31050","CSAFPID-31051","CSAFPID-31054","CSAFPID-31055","CSAFPID-31056","CSAFPID-31057","CSAFPID-31058","CSAFPID-31059","CSAFPID-31060","CSAFPID-11008","CSAFPID-11009"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","environmentalScore":9.8,"environmentalSeverity":"CRITICAL","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","temporalScore":9.8,"temporalSeverity":"CRITICAL","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.0"},"products":["CSAFPID-31045","CSAFPID-31046","CSAFPID-31047","CSAFPID-31048","CSAFPID-31049","CSAFPID-31050","CSAFPID-31051","CSAFPID-31054","CSAFPID-31055","CSAFPID-31056","CSAFPID-31057","CSAFPID-31058","CSAFPID-31059","CSAFPID-31060","CSAFPID-11008","CSAFPID-11009"]}],"title":"CVE-2019-9201"}]}