CVE-2025-41669

HighCVSS 8.8/10Last modified Oct 14, 2026

Description

The Web-based Management allows a remote low privileged Engineer user to install additional APPs on the device downloaded from the PLCnext Store without implementing any data verification mechanism, leading to the capability for an Engineer user to reach arbitrary code execution with root privileges on the PLC device. A successful exploitation may allow to install a manipulated APP package, potentially impacting integrity and availability of the PLCnext Control.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-347

Affected software

Vendor	Product	Versions
Phoenix Contact	AXC F 1152	>= 0.0.0, < 2026.0.3
Phoenix Contact	AXC F 1252	>= 0.0.0, < 2026.0.3
Phoenix Contact	AXC F 2000 EA	>= 0.0.0, < 2026.0.3
Phoenix Contact	AXC F 2152	>= 0.0.0, < 2026.0.3
Phoenix Contact	AXC F 3152	>= 0.0.0, < 2026.0.3
Phoenix Contact	BPC 9102S	>= 0.0.0, < 2026.0.3
Phoenix Contact	EPC 1522	>= 0.0.0, < 2026.0.3
Phoenix Contact	RFC 4072R	>= 0.0.0, < 2026.0.3
Phoenix Contact	RFC 4072S	>= 0.0.0, < 2026.0.3
Phoenix Contact	VL3 UPC 2440 EDGE	>= 0.0.0, < 2026.0.3
Phoenix Contact	VPLCNEXT CONTROL 1000	>= 0.0.0, < 2026.0.3
Phoenix Contact	VPLCNEXT CONTROL 2000	>= 0.0.0, < 2026.0.3
Phoenix Contact	VPLCNEXT CONTROL 3000	>= 0.0.0, < 2026.0.3
Phoenix Contact	VPLCNEXT CONTROL 500	>= 0.0.0, < 2026.0.3

References

https://www.certvde.com/en/advisories/VDE-2026-050/

Timeline

Published: May 27, 2026
Last modified: Oct 14, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-416707.8A local user with low privileges may be able to influence the behavior of a privileged system service by manipulating configuration or appli CVE-2025-4167210.0A remote unauthenticated attacker may use default certificates to generate JWT Tokens and gain full access to the tool and all connected dev CVE-2025-416737.2A high privileged remote attacker can execute arbitrary system commands via POST requests in the send_sms action due to improper neutralizat CVE-2025-416747.2A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutraliz CVE-2025-416757.2A high privileged remote attacker can execute arbitrary system commands via GET requests in the cloud server communication script due to imp CVE-2025-416764.9A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-sms action CVE-2025-416774.9A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-mail actio CVE-2025-416787.2A high privileged remote attacker can alter the configuration database via POST requests due to improper neutralization of special elements CVE-2025-416797.5An unauthenticated remote attacker could exploit a buffer overflow vulnerability in the device causing a denial of service that affects only CVE-2025-41686.4The Subpage List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'subpages' shortcode in all versions up CVE-2025-416814.8A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to creat CVE-2025-416828.8An authenticated, low-privileged attacker can obtain credentials stored on the charge controller including the manufacturer password.