Phoenix Contact vulnerabilities, page 4
190 vulnerabilities
Known vulnerabilities in Phoenix Contact products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 249 products.
HighCVE-2025-24003phoenix contact · charx sec-3000 +7 moreMQTT OOB Write Vulnerability in EichrechtAgents of German EV Charging StationsAn unauthenticated remote attacker can use MQTT messages to trigger out-of-bounds writes in charging stations complying with German Calibration Law, resulting in a loss of integrity for only EichrechtAgents and potential denial-of-service for these stations.EPSS0.40%HighCVE-2025-24006phoenix contact · charx sec-3000 +7 morePrivilege Escalation via Insecure SSH PermissionsA low privileged local attacker can leverage insecure permissions via SSH on the affected devices to escalate privileges to root.EPSS0.13%MediumCVE-2025-24004phoenix contact · charx sec-3000 +7 moreUSB-C Buffer Overflow via Display Interface in EV Charging StationsA physical attacker with access to the device display via USB-C can send a message to the device which triggers an unsecure copy to a buffer resulting in loss of integrity and a temporary denial-of-service for the stations until they got restarted by the watchdog.EPSS0.19%MediumCVE-2025-24002phoenix contact · charx sec-3000 +7 moreMQTT DoS Vulnerability in German EV Charging StationsAn unauthenticated remote attacker can use MQTT messages to crash a service on charging stations complying with German Calibration Law, resulting in a temporary denial-of-service for these stations until they got restarted by the watchdog.EPSS0.43%HighCVE-2025-24005phoenix contact · charx sec-3000 +7 moreLocal Privilege Escalation via Vulnerable SSH ScriptA local attacker with a local user account can leverage a vulnerable script via SSH to escalate privileges to root due to improper input validation.EPSS0.14%CriticalCVE-2020-12519phoenix contact · axc f 1152 (1151412) +6 morePhoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An attacker can use this vulnerability i.e. to open a reverse shell with root privileges.On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use this vulnerability i.e. to open a reverse shell with root privileges.EPSS0.86%HighCVE-2020-12497phoenix contact · automation worx +3 morePhoenix Contact Automation Worx <= 1.87: stack-based overflowPLCopen XML file parsing in Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier can lead to a stack-based overflow. Manipulated PC Worx projects could lead to a remote code execution due to insufficient input data validation.EPSS14.67%HighCVE-2020-12499phoenix contact · plcnext engineer +1 morePHOENIX CONTACT PLCnext Engineer version 2020.3.1 and earlier: Improper path sanitation vulnerability.In PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and earlier an improper path sanitation vulnerability exists on import of project files.EPSS0.40%HighCVE-2020-12524phoenix contact · btp touch panelPhoenix Contact BTP Touch Panels uncontrolled resource consumptionUncontrolled Resource Consumption can be exploited to cause the Phoenix Contact HMIs BTP 2043W, BTP 2070W and BTP 2102W in all versions to become unresponsive and not accurately update the display content (Denial of Service).EPSS1.08%CriticalCVE-2020-12517phoenix contact · axc f 1152 (1151412) +6 morePhoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An authenticated low privileged user could embed malicious Javascript code to gain admin rights when the admin user visits the vulnerable website (local privilege escalation).On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an authenticated low privileged user could embed malicious Javascript code to gain admin rights when the admin user visits the vulnerable website (local privilege escalation).EPSS1.12%HighCVE-2020-12498phoenix contact · automation worx +3 morePhoenix Contact Automation Worx <= 1.87: out-of-bounds read remote code executionmwe file parsing in Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier is vulnerable to out-of-bounds read remote code execution. Manipulated PC Worx projects could lead to a remote code execution due to insufficient input data validation.EPSS2.11%MediumCVE-2020-12521phoenix contact · axc f 1152 (1151412) +6 morePhoenix Contact PLCnext Control Devices versions before 2021.0 LTS: A specially crafted LLDP packet may lead to a high system load in the PROFINET stack.On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS a specially crafted LLDP packet may lead to a high system load in the PROFINET stack. An attacker can cause failure of system services or a complete reboot.EPSS0.46%MediumCVE-2020-12518phoenix contact · axc f 1152 (1151412) +6 morePhoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An attacker can use the knowledge gained by reading the insufficiently protected sensitive information to plan further attacks.On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use the knowledge gained by reading the insufficiently protected sensitive information to plan further attacks.EPSS0.75%CriticalCVE-2020-12523innominate · innominate mguard rs4000 4tx/3g/tx vpn +17 morePhoenix Contact mGuard Devices versions before 8.8.3: LAN ports get functional after reboot even if they are disabled in the device configurationOn Phoenix Contact mGuard Devices versions before 8.8.3 LAN ports get functional after reboot even if they are disabled in the device configuration. For mGuard devices with integrated switch on the LAN side, single switch ports can be disabled by device configuration. After a reboot these ports get functional independent from their configuration setting: Missing Initialization of ResourceEPSS0.90%CriticalCVE-2014-9195phoenix contact · multiprog +2 morePhoenix Contact Software ProConOs and MultiProg Missing Authentication for Critical FunctionPhoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffic.EPSS80.69%CriticalCVE-2022-31800phoenix contact · axc 1050 +16 moreInsufficient Verification of Data Vulnerability in PHOENIX CONTACT classic line industrial controllersAn unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.EPSS1.57%CriticalCVE-2022-31801phoenix contact · multiprog +3 moreInsufficient Verification of Data Vulnerability in ProConOS/ProConOS eCLR SDK and MULTIPROG Engineering toolAn unauthenticated, remote attacker could upload malicious logic to the devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.EPSS1.14%CriticalCVE-2022-29898phoenix contact · rad-ism-900-en-bd +2 moreRemote Code Execution in all versions of various RAD-ISM-900-EN-* devices by PHOENIX CONTACTOn various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the configuration file uploader in the WebUI to execute arbitrary code with root privileges on the OS due to an improper validation of an integrity check value in all versions of the firmware.EPSS0.65%CriticalCVE-2022-29897phoenix contact · rad-ism-900-en-bd +2 moreRemote Code Execution in all versions of various RAD-ISM-900-EN-* devices by PHOENIX CONTACTOn various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the traceroute utility integrated in the WebUI to execute arbitrary code with root privileges on the OS due to an improper input validation in all versions of the firmware.EPSS1.36%HighCVE-2022-3480phoenix contact · fl mguard centerport +61 moreDenial-of-Service vulnerability in PHOENIX CONTACT mGuard product familyA remote, unauthenticated attacker could cause a denial-of-service of PHOENIX CONTACT FL MGUARD and TC MGUARD devices below version 8.9.0 by sending a larger number of unauthenticated HTTPS connections originating from different source IP’s. Configuring firewall limits for incoming connections cannot prevent the issue.EPSS0.93%