Phoenix Contact vulnerabilities, page 2
190 vulnerabilities
Known vulnerabilities in Phoenix Contact products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 249 products.
CVE-2021-33555pepperl-fuchswha-gw-f2d2-0-as-_z2-eth.eip_firmware+3
EPSS score1.21%
In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.7 the filename parameter is vulnerable to unauthenticated path traversal attacks, enabling read access to arbitrary files on the server.CVE-2016-8371phoenix contactphoenix contact ilc plcs+1EPSS score10.85%
The web server in Phoenix Contact ILC PLCs can be accessed without authenticating even if the authentication mechanism is enabled.CVE-2016-8380phoenix contactphoenix contact ilc plcs+1EPSS score10.85%
The web server in Phoenix Contact ILC PLCs allows access to read and write PLC variables without authentication.CVE-2016-8366phoenix contactphoenix contact ilc plcs+1EPSS score5.71%
Webvisit in Phoenix Contact ILC PLCs offers a password macro to protect HMI pages on the PLC against casual or coincidental opening of HMI pages by the user. The password macro can be configured in a way that the password is stored and transferred in clear text.CVE-2025-2813phoenix contactaxl f bk eip+13EPSS score0.66%
An unauthenticated remote attacker can cause a Denial of Service by sending a large number of requests to the http service on port 80.CVE-2025-41771phoenix contactaxc f 1152+16EPSS score0.27%
An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification functionality.CVE-2025-41745phoenix contactfl nat 2008+137EPSS score0.65%
An XSS vulnerability in pxc_portCntr2.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.CVE-2025-41748phoenix contactfl nat 2008+137EPSS score9.77%
An XSS vulnerability in pxc_Dot1xCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.CVE-2025-41769phoenix contactaxc f 1152+14EPSS score0.84%
The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default configuration. An unauthenticated remote attacker could exploit this vulnerability to reboot the device or execute arbitrary code.CVE-2025-41705phoenix contactquint4-ups/24dc/24dc/10/eip+3EPSS score0.46%
An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend.CVE-2025-41706phoenix contactquint4-ups/24dc/24dc/10/eip+3EPSS score1.67%
The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-length to trigger the issue without affecting the core functionality.CVE-2025-41707phoenix contactquint4-ups/24dc/24dc/10/eip+3EPSS score1.41%
The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the issue without affecting the core functionality.CVE-2025-41749phoenix contactfl nat 2008+137EPSS score0.65%
An XSS vulnerability in port_util.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.CVE-2025-41666phoenix contactaxc f 1152+4EPSS score0.60%
A low privileged remote attacker with file access can replace a critical file used by the watchdog to get read, write and execute access to any file on the device after the watchdog has been initialized.CVE-2025-41695phoenix contactfl nat 2008+137EPSS score0.66%
An XSS vulnerability in dyn_conn.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.CVE-2025-41751phoenix contactfl nat 2008+137EPSS score9.77%
An XSS vulnerability in pxc_portCntr.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.CVE-2025-41669phoenix contactaxc f 1152+13EPSS score0.22%
The Web-based Management allows a remote low privileged Engineer user to install additional APPs on the device downloaded from the PLCnext Store without implementing any data verification mechanism, leading to the capability for an Engineer user to reach arbitrary code execution with root privileges on the PLC device. A successful exploitation may allow to install a manipulated APP package, potentially impacting integrity and availability of the PLCnext Control.CVE-2025-41694phoenix contactfl nat 2008+137EPSS score0.48%
A low privileged remote attacker can run the webshell with an empty command containing whitespace. The server will then block until it receives more data, resulting in a DoS condition of the websserver.CVE-2025-41692phoenix contactfl nat 2008+137EPSS score0.30%
A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak password generation algorithm.CVE-2025-41746phoenix contactfl nat 2008+137EPSS score9.77%
An XSS vulnerability in pxc_portSecCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.