Security readout for executives and security teams
Plain-English summary
This flaw can compromise an engineering workstation if a user opens or uses a tampered Phoenix Contact project file. The attacker must first obtain and replace an original bus configuration file, so this is targeted rather than worm-like. Operational automation systems already programmed with these tools are stated as not affected.
Executive priority
Treat this as high priority for OT engineering environments using affected Phoenix Contact tooling. It is not described as affecting running automation systems, but compromise of a programming workstation can threaten confidentiality, integrity, and availability of engineering operations.
Technical view
CVE-2021-33542 affects Phoenix Contact Classic Automation Worx Software Suite version 1.87 and below, including PC Worx, PC Worx Express, and Config+. Manipulated PC Worx or Config+ projects can trigger remote code execution through freeing unallocated memory from incompletely initialized data, mapped to CWE-824. CVSS is 7.8 with local access and user interaction required.
Likely exposure
Exposure is most likely on engineering or application programming workstations using affected Phoenix Contact software and handling PC Worx, Config+, or *.bcp project data. The source states automated systems in operation programmed with these products are not affected.
Exploitation context
The provided sources do not establish active exploitation, and the CVE is not marked KEV. Exploitation requires access to an original *.bcp bus configuration file, manipulation of its contents, and replacement of the original file on the programming workstation.
Researcher notes
The key constraints are important: CVSS AV:L and UI:R, attacker access to an original *.bcp file, and replacement on the programming workstation. The bundle does not name a fixed version, workaround, exploit availability, or active exploitation, so remediation should be tied to vendor advisory confirmation.
Mitigation direction
- Identify workstations running Automation Worx Software Suite version 1.87 or below.
- Review Phoenix Contact and VDE guidance for available updates or supported workarounds.
- Restrict write access to project directories and original *.bcp files.
- Accept project files only from trusted sources and controlled engineering workflows.
- Back up known-good project files before opening or modifying projects.
Validation and detection
- Inventory PC Worx, PC Worx Express, and Config+ installations and versions.
- Confirm whether any installations are version 1.87 or below.
- Review project directories for unexpected *.bcp replacements or timestamp changes.
- Check recent engineering workstation activity around project file handling.
- Verify remediation status against Phoenix Contact or VDE advisory guidance.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-824: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-33542 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H1.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://cert.vde.com/en-us/advisories/vde-2021-020CVE reference · x_refsource_CONFIRM
- https://www.zerodayinitiative.com/advisories/ZDI-21-782/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Access of Uninitialized Pointer
Access of Uninitialized Pointer represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.