mwe file parsing in Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier is vulnerable to out-of-bounds read remote code execution. Manipulated PC Worx projects could lead to a remote code execution due to insufficient input data validation.

mwe file parsing in Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier is vulnerable to out-of-bounds read remote code execution. Manipulated PC Worx projects could lead to a remote code execution due to insufficient input data validation.

Due to insufficient input data validation while processing project files the buffer could be overflown. An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application.CVE-2020-12497 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Insufficient input data validation while processing project files could result in an out-of-bounds read. An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application.CVE-2020-12498 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

Manipulated PC Worx projects could lead to a remote code execution due to insufficient input data validation.

The attacker needs to get access to an original PC Worx project to be able to manipulate data inside the project folder. After manipulation the attacker needs to exchange the original files by the manipulated ones on the application programming workstation.