CVE-2021-34597
📋 TL;DR
This vulnerability allows an attacker to write arbitrary files outside the intended project directory by exploiting improper input validation in PC Worx Automation Suite. Attackers can achieve this by tricking users into opening a malicious project file. Systems running affected versions of PC Worx Automation Suite are vulnerable.
💻 Affected Systems
- PC Worx Automation Suite
📦 What is this software?
Pc Worx by Phoenixcontact
Pc Worx Express by Phoenixcontact
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through arbitrary file write leading to remote code execution, data destruction, or system takeover.
Likely Case
Local file system manipulation allowing attackers to overwrite critical system files or plant malware.
If Mitigated
Limited impact if proper file integrity monitoring and user privilege restrictions are in place.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious project file.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.89 or later
Vendor Advisory: https://cert.vde.com/en/advisories/VDE-2021-052/
Restart Required: Yes
Instructions:
1. Download PC Worx Automation Suite version 1.89 or later from Phoenix Contact. 2. Install the update following vendor instructions. 3. Restart the system.
🔧 Temporary Workarounds
Restrict project file sources
allOnly open project files from trusted sources and implement file integrity checking.
User privilege reduction
windowsRun PC Worx Automation Suite with limited user privileges to restrict file system access.
🧯 If You Can't Patch
- Implement strict access controls to limit who can open project files.
- Deploy application whitelisting to prevent execution of unauthorized files.
🔍 How to Verify
Check if Vulnerable:
Check PC Worx Automation Suite version in Help > About. If version is 1.88 or earlier, system is vulnerable.Check Version:
Check Help > About in PC Worx Automation Suite GUI.Verify Fix Applied:
Verify version is 1.89 or later in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Unusual file write operations outside project directories
- Multiple failed project file load attempts
Network Indicators:
- Unexpected network connections after opening project files
SIEM Query:
EventID=4663 AND ObjectName LIKE '%\..\%' AND ProcessName='PCWorx.exe'