CVE Feed

    Dashboard / CVE / CVE-2022-3737

    CVE-2022-3737

    In PHOENIX CONTACT Automationworx Software Suite up to version 1.89 memory can be read beyond the intended scope due to insufficient validation of input data. Availability, integrity, or confidentiality of an application programming workstation might be compromised by attacks using these vulnerabilities.

    Published:Nov 15, 2022
    Last Modified:Apr 28, 2025
    EPS:Nov 15, 2022
    EPSS Score:0.00041
    CVSS Score:7.8

    Affected Products

    Vendor
    Phoenixcontact
    Product
    Automationworx Software Suite

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-125 Out-of-bounds Read

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-540 Overread Buffers

    Related CVEs

    CVE-2023-46143 (CVSS 7.5) — Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthen…
    CVE-2023-46141 (CVSS 9.8) — Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTAC…
    CVE-2022-3461 (CVSS 7.8) — In PHOENIX CONTACT Automationworx Software Suite up to version 1.89 manipulated PC Worx or Config+ files could…
    CVE-2019-12869 (CVSS 8.8) — An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ thr…
    CVE-2019-12870 (CVSS 8.8) — An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ thr…
    CVE-2019-12871 (CVSS 8.8) — An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ thr…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High