PHOENIX CONTACT Security Advisory for Automation Worx Software Suite (Update A)

Phoenix Contact Automationworx Suite: *.bcp-file Memory Corruption Remote Code Execution Vulnerability and *.mwt-file Out-OfBounds Read Remote Code Execution Vulnerability

VDE-2019-016 (2019-10-15 09:17 UTC+0200)

CVE Identifier


Affected Vendors

Phoenix Contact

Affected Products

Following components of Automationworx Software Suite version 1.86 and earlier are affected:
PC Worx
PC Worx Express

Vulnerability Type

Out-of-bounds Read (CWE-125)


Manipulated PC Worx or Config+ projects could lead to a remote code execution due to
insufficient input data validation.
The attacker needs to get access to an original PC Worx or Config+ project to be able to
manipulate data inside the project folder. After manipulation the attacker needs to exchange the
original files by the manipulated ones on the application programming workstation.


Availability, integrity, or confidentiality of an application programming workstation might be compromised by attacks using these vulnerabilities. Automated systems in operation which were programmed with one of the above-mentioned products are not affected.


Temporary Fix / Mitigation

We strongly recommend customers to exchange project files only using secure file exchange services. Project files should not be exchanged via unencrypted email.


With the next version of Automationworx Software Suite a sharpened validation of arrays regarding dimension and number of elements during input data conversion will be implemented. To improve the robustness against manipulated project files the input data validation will be extended. Further preventive security measures will be activated in the compiler settings.

Update A, 2020-02-24

Above-mentioned improvements have been implemented in Automationworx Software Suite 1.87 which is available for download now.

Reported by

The vulnerabilities were discovered by 9sg Security Team.
Reported through Zerodayinitiative (ZDI-CAN-7782 and ZDI-CAN-8097).
Coordinated by CISA and CERT@VDE.