Phoenix Contact PLCNext AXC F 2152 (ICSA-19-155-01)

The NCCIC has published an advisory on key management errors, improper access control, using component with known vulnerabilities, and man-in-the-middle vulnerabilities in Phoenix Contact PLCNext AXC F 2152. Article numbers 2404267 and 1046568 are affected. Successful exploitation of these vulnerabilities could allow an attacker to decrypt passwords, bypass authentication, and deny service to the device. In addition, these vulnerabilities could interact with third-party vulnerabilities to cause other impacts to integrity, confidentiality, and availability. Phoenix Contact recommends affected users update to firmware release 2019.0 LTS or later, update to PLCNext Engineer release 2019.0 LTS or later, and apply the specific mitigations. The NCCIC also recommends a series of mitigating measures. Read the advisory at NCCIC/ICS-CERT.