Phoenix Contact Classic Line Industrial Controllers

Risk Summary

Successful exploitation of this vulnerability could allow an unauthorized attacker to change configurations, manipulate services, or cause a denial-of-service condition.

CVEs (1)

Remediations

• Phoenix Contact classic line controllers are designed and developed for use in closed industrial networks. The control and configuration protocols do not feature authentication mechanisms by design. Phoenix Contact recommends using the devices exclusively in closed networks, protected by a suitable firewall.
• If the use of an affected controller in protected zones is not suitable, OT communication protocols should be disabled either by using the CPU services via console or web-based management according to the controller type.
• Information for which controllers and from which firmware version communication protocols can be disabled are described in Phoenix Contact's application note for classic line controllers, or the manual to the respective controller, which is available for download at the Phoenix Contact website.
• For detailed information on Phoenix Contact's recommendations for measures to protect network-capable devices, please refer to their application note for classic line controllers
• Measures to protect devices based on classic control technology
• ILC 1x0: All variants, firmware: no fix
• ILC 1x1: All variants, firmware: 4.42
• ILC 1x1 GMS/GPRS: Article number2700977, firmware: 4.42
• ILC 3xx: All variants, firmware 3.98
• AXC 1050: Article number 2700988, firmware 3.01, 5.00 (WBM)
• AXC 1050XC: Article number 2701295, firmware 3.01, 5.00 (WBM)
• AXC 3050: Article number 2700989, firmware 5.60, 6.30 (WBM)
• RFC 480S PN 4TX: Article number 2404577, firmware 6.10
• RFC 470 PN 3TX: Article number 291660, firmware 4.20
• RFC 470S PN 3TX: Article number 2916794, firmware 4.20
• RFC 460R PN 3TX: Article number 2700784, firmware 5.00
• RFC 460R PN 3TX-S: Article number 1096407, firmware 5.30
• RFC 430 ETH-IB: Article number 2730190, no fix
• RFC 450 ETH-IB: Article number 2730200, no fix
• PC WORX SRT: Article number 2701680, no fix
• PC WORX RT BASIC: Article number 2700291, no fix
• FC 350 PCI ETH: Article number 2730844, no fix

Affected Vendors

Affected Products (14)

Affected Sectors

Multiple Sectors