High severity8.8NVD Advisory· Published Apr 17, 2023· Updated Jun 17, 2026
CVE-2023-1109
CVE-2023-1109
Description
In Phoenix Contacts ENERGY AXC PU Web service an authenticated restricted user of the web frontend can access, read, write and create files throughout the file system using specially crafted URLs via the upload and download functionality of the web service. This may lead to full control of the service.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
10cpe:2.3:a:phoenixcontact:energy_axc_pu:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:phoenixcontact:energy_axc_pu:*:*:*:*:*:*:*:*range: >=01.00.00.00,<=04.15.00.00
- (no CPE)range: V01.00.00.00
- cpe:2.3:o:phoenixcontact:infobox_firmware:*:*:*:*:*:*:*:*Range: >=01.00.00.00,<=02.02.00.00
- cpe:2.3:o:phoenixcontact:smartrtu_axc_ig_firmware:*:*:*:*:*:*:*:*Range: >=01.00.00.00,<=01.02.00.01
- cpe:2.3:o:phoenixcontact:smartrtu_axc_sg_firmware:*:*:*:*:*:*:*:*Range: >=01.00.00.00,<=01.08.00.02
- PHOENIX CONTACT/Infobox (1169323 )v5Range: V01.00.00.00
- PHOENIX CONTACT/SMARTRTU AXC IG (1264328)v5Range: V01.00.00.00
- PHOENIX CONTACT/SMARTRTU AXC SG (1110435)v5Range: V01.00.00.00
Patches
Vulnerability mechanics
References
2- github.com/advisories/GHSA-w923-8w64-f5ghnvdThird Party Advisory
- cert.vde.com/en/advisories/VDE-2023-003/nvdNot Applicable
News mentions
0No linked articles in our index yet.