Phoenixcontact vulnerabilities, page 3
145 vulnerabilities
Known vulnerabilities in Phoenixcontact products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 351 products.
CVE-2025-25268phoenix contactcharx sec-3000+7
EPSS score0.36%
An unauthenticated adjacent attacker can modify configuration by sending specific requests to an API-endpoint resulting in read and write access due to missing authentication.CVE-2025-25269phoenix contactcharx sec-3000+7EPSS score0.30%
An unauthenticated local attacker can inject a command that is subsequently executed as root, leading to a privilege escalation.CVE-2025-25270phoenix contactcharx sec-3000+7EPSS score0.75%
An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations.CVE-2025-24003phoenix contactcharx sec-3000+7EPSS score0.40%
An unauthenticated remote attacker can use MQTT messages to trigger out-of-bounds writes in charging stations complying with German Calibration Law, resulting in a loss of integrity for only EichrechtAgents and potential denial-of-service for these stations.CVE-2025-24006phoenix contactcharx sec-3000+7EPSS score0.13%
A low privileged local attacker can leverage insecure permissions via SSH on the affected devices to escalate privileges to root.CVE-2025-24004phoenix contactcharx sec-3000+7EPSS score0.19%
A physical attacker with access to the device display via USB-C can send a message to the device which triggers an unsecure copy to a buffer resulting in loss of integrity and a temporary denial-of-service for the stations until they got restarted by the watchdog.CVE-2025-24002phoenix contactcharx sec-3000+7EPSS score0.43%
An unauthenticated remote attacker can use MQTT messages to crash a service on charging stations complying with German Calibration Law, resulting in a temporary denial-of-service for these stations until they got restarted by the watchdog.CVE-2025-24005phoenix contactcharx sec-3000+7EPSS score0.14%
A local attacker with a local user account can leverage a vulnerable script via SSH to escalate privileges to root due to improper input validation.CVE-2020-9435phoenixcontacttc_cloud_client_1002-4g_firmware+5EPSS score1.16%
PHOENIX CONTACT TC ROUTER 3002T-4G through 2.05.3, TC ROUTER 2002T-3G through 2.05.3, TC ROUTER 3002T-4G VZW through 2.05.3, TC ROUTER 3002T-4G ATT through 2.05.3, TC CLOUD CLIENT 1002-4G through 2.03.17, and TC CLOUD CLIENT 1002-TXTX through 1.03.17 devices contain a hardcoded certificate (and key) that is used by default for web-based services on the device. Impersonation, man-in-the-middle, or passive decryption attacks are possible if the generic certificate is not replaced by a device-specific certificate during installation.CVE-2020-9436phoenixcontacttc_cloud_client_1002-4g_firmware+5EPSS score2.61%
PHOENIX CONTACT TC ROUTER 3002T-4G through 2.05.3, TC ROUTER 2002T-3G through 2.05.3, TC ROUTER 3002T-4G VZW through 2.05.3, TC ROUTER 3002T-4G ATT through 2.05.3, TC CLOUD CLIENT 1002-4G through 2.03.17, and TC CLOUD CLIENT 1002-TXTX through 1.03.17 devices allow authenticated users to inject system commands through a modified POST request to a specific URL.CVE-2020-10939phoenixcontactpc_worx_srt_firmwareEPSS score0.30%
Insecure, default path permissions in PHOENIX CONTACT PC WORX SRT through 1.14 allow for local privilege escalation.CVE-2020-10940phoenixcontactportico_server_1_client+2EPSS score0.30%
Local Privilege Escalation can occur in PHOENIX CONTACT PORTICO SERVER through 3.0.7 when installed to run as a service.CVE-2020-12519phoenix contactaxc f 1152 (1151412)+6EPSS score0.86%
On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use this vulnerability i.e. to open a reverse shell with root privileges.CVE-2020-12497phoenix contactautomation worx+3EPSS score14.67%
PLCopen XML file parsing in Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier can lead to a stack-based overflow. Manipulated PC Worx projects could lead to a remote code execution due to insufficient input data validation.CVE-2020-12499phoenix contactplcnext engineer+1EPSS score0.40%
In PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and earlier an improper path sanitation vulnerability exists on import of project files.CVE-2020-12517phoenix contactaxc f 1152 (1151412)+6EPSS score1.12%
On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an authenticated low privileged user could embed malicious Javascript code to gain admin rights when the admin user visits the vulnerable website (local privilege escalation).CVE-2020-12498phoenix contactautomation worx+3EPSS score2.11%
mwe file parsing in Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier is vulnerable to out-of-bounds read remote code execution. Manipulated PC Worx projects could lead to a remote code execution due to insufficient input data validation.CVE-2020-12521phoenix contactaxc f 1152 (1151412)+6EPSS score0.46%
On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS a specially crafted LLDP packet may lead to a high system load in the PROFINET stack. An attacker can cause failure of system services or a complete reboot.CVE-2020-12518phoenix contactaxc f 1152 (1151412)+6EPSS score0.75%
On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use the knowledge gained by reading the insufficiently protected sensitive information to plan further attacks.CVE-2020-12523innominateinnominate mguard rs4000 4tx/3g/tx vpn+17EPSS score0.90%
On Phoenix Contact mGuard Devices versions before 8.8.3 LAN ports get functional after reboot even if they are disabled in the device configuration. For mGuard devices with integrated switch on the LAN side, single switch ports can be disabled by device configuration. After a reboot these ports get functional independent from their configuration setting: Missing Initialization of Resource