CVE-2025-41771

MediumCVSS 4.3/10Last modified Sep 29, 2026

Description

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification functionality.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-89

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Phoenix Contact	AXC F 1152	>= 2019.0.4, < 2026.0.3
Phoenix Contact	AXC F 1252	>= 2019.0.4, < 2026.0.3
Phoenix Contact	AXC F 2000 EA	>= 2019.0.4, < 2026.0.3
Phoenix Contact	AXC F 2152	>= 2019.0.4, < 2026.0.3
Phoenix Contact	AXC F 3152	>= 2019.0.4, < 2026.0.3
Phoenix Contact	BPC 9102S	>= 2019.0.4, < 2026.0.3
Phoenix Contact	BPC 9202S	>= 2019.0.4, < 2026.0.3
Phoenix Contact	RFC 4072R	>= 2019.0.4, < 2026.0.3
Phoenix Contact	RFC 4072S	>= 2019.0.4, < 2026.0.3
Phoenix Contact	VL3 UPC 2440 EDGE	>= 2019.0.4, < 2026.0.3
Phoenix Contact	VPLCNEXT CONTROL 1000	>= 2019.0.4, < 2026.0.3
Phoenix Contact	VPLCNEXT CONTROL 2000	>= 2019.0.4, < 2026.0.3
Phoenix Contact	VPLCNEXT CONTROL 3000	>= 2019.0.4, < 2026.0.3
Phoenix Contact	VPLCNEXT CONTROL 500	>= 2019.0.4, < 2026.0.3
Phoenix Contact	Catan C1	>= 2019.0.4, < 2026.0.3
Phoenix Contact	EPC 1502	>= 2019.0.4, < 2026.0.3
Phoenix Contact	EPC 1522	>= 2019.0.4, < 2026.0.3

References

https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2025-056.json

Timeline

Published: Aug 12, 2026
Last modified: Sep 29, 2026
NVD status: Awaiting Analysis

Related CVEs from 2025

CVE-2025-417727.5An unauthenticated remote attacker can obtain valid session tokens because they are exposed in plaintext within the URL parameters of the ww CVE-2025-41785.4A vulnerability was found in xiaowei1118 java_server up to 11a5bac8f4ba1c17e4bc1b27cad6d24868500e3a on Windows and classified as critical. T CVE-2025-41797.3The Flynax Bridge plugin for WordPress is vulnerable to limited Privilege Escalation due to a missing capability check on the registerUser()CVE-2025-41809.8A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as critical. Affected is an unknown function of the component TR CVE-2025-41819.8A vulnerability was found in PCMan FTP Server 2.0.7. It has been declared as critical. Affected by this vulnerability is an unknown function CVE-2025-41829.8A vulnerability was found in PCMan FTP Server 2.0.7. It has been rated as critical. Affected by this issue is some unknown functionality of CVE-2025-41839.8A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. This affects an unknown part of the component RECV Command CVE-2025-41849.8A vulnerability classified as critical was found in PCMan FTP Server 2.0.7. This vulnerability affects unknown code of the component QUOTE C CVE-2025-41856.3A vulnerability, which was classified as critical, has been found in Wangshen SecGate 3600 2024. This issue affects some unknown processing CVE-2025-41866.3A vulnerability, which was classified as critical, was found in Wangshen SecGate 3600 2024. Affected is an unknown function of the file /?g=CVE-2025-41875.9The UserPro - Community and User Profile WordPress Plugin plugin for WordPress is vulnerable to Directory Traversal in all versions up to, a CVE-2025-41886.1The Advanced Reorder Image Text Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including