Phoenix Contact vulnerabilities, page 3
190 vulnerabilities
Known vulnerabilities in Phoenix Contact products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 249 products.
CVE-2025-41696phoenix contactfl nat 2008+137
EPSS score0.21%
An attacker can use an undocumented UART port on the PCB as a side-channel with the user hardcoded credentials obtained from CVE-2025-41692 to gain read access to parts of the filesystem of the device.CVE-2025-41668phoenix contactaxc f 1152+4EPSS score0.60%
A low privileged remote attacker with file access can replace a critical file or folder used by the service security-profile to get read, write and execute access to any file on the device.CVE-2025-41770phoenix contactaxc f 1152+16EPSS score0.55%
An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an remote attacker to interrupt access via the client application. Successful exploitation prevents communication until the PLCnext service is manually restarted.CVE-2025-41699phoenix contactcharx sec-3000+3EPSS score0.85%
An low privileged remote attacker with an account for the Web-based management can change the system configuration to perform a command injection as root, resulting in a total loss of confidentiality, availability and integrity due to improper control of generation of code ('Code Injection').CVE-2025-41747phoenix contactfl nat 2008+137EPSS score9.77%
An XSS vulnerability in pxc_vlanIntfCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.CVE-2025-41752phoenix contactfl nat 2008+137EPSS score9.77%
An XSS vulnerability in pxc_portSfp.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.CVE-2025-41693phoenix contactfl nat 2008+137EPSS score0.52%
A low privileged remote attacker can use the ssh feature to execute commands directly after login. The process stays open and uses resources which leads to a reduced performance of the management functions. Switching functionality is not affected.CVE-2025-41670phoenix contactaxc f 1152+13EPSS score0.19%
A local user with low privileges may be able to influence the behavior of a privileged system service by manipulating configuration or application-related files located in user-writable areas of the filesystem. The affected service processes data from locations that are not sufficiently protected against modification by low-privileged users. As the service runs with elevated privileges, successful exploitation may result in a local privilege escalation.CVE-2025-41686phoenix contactdaumEPSS score0.13%
A low-privileged local attacker can exploit improper permissions on nssm.exe to escalate their privileges and gain administrative access.CVE-2025-41717phoenix contactcloud client 1101t-tx/tx+10EPSS score0.55%
An unauthenticated remote attacker can trick a high privileged user into uploading a malicious payload via the config-upload endpoint, leading to code injection as root. This results in a total loss of confidentiality, availability and integrity due to improper control of code generation ('Code Injection’).CVE-2025-41697phoenix contactfl nat 2008+137EPSS score0.24%
An attacker can use an undocumented UART port on the PCB as a side-channel to get root access e.g. with the credentials obtained from CVE-2025-41692.CVE-2025-41703phoenix contactquint4-ups/24dc/24dc/10/eip+3EPSS score1.05%
An unauthenticated remote attacker can cause a Denial of Service by turning off the output of the UPS via Modbus command.CVE-2025-41750phoenix contactfl nat 2008+137EPSS score9.77%
An XSS vulnerability in pxc_PortCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.CVE-2025-41704phoenix contactquint4-ups/24dc/24dc/10/eip+3EPSS score1.59%
An unauthanticated remote attacker can perform a DoS of the Modbus service by sending a specific function and sub-function code without affecting the core functionality.CVE-2025-41667phoenix contactaxc f 1152+4EPSS score0.60%
A low privileged remote attacker with file access can replace a critical file used by the arp-preinit script to get read, write and execute access to any file on the device.CVE-2025-41665phoenix contactaxc f 1152+4EPSS score0.36%
An low privileged remote attacker can enforce the watchdog of the affected devices to reboot the PLC due to incorrect default permissions of a config file.CVE-2025-25271phoenix contactcharx sec-3000+7EPSS score0.35%
An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface.CVE-2025-25268phoenix contactcharx sec-3000+7EPSS score0.36%
An unauthenticated adjacent attacker can modify configuration by sending specific requests to an API-endpoint resulting in read and write access due to missing authentication.CVE-2025-25269phoenix contactcharx sec-3000+7EPSS score0.30%
An unauthenticated local attacker can inject a command that is subsequently executed as root, leading to a privilege escalation.CVE-2025-25270phoenix contactcharx sec-3000+7EPSS score0.75%
An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations.