Skip to content
OpenAdvisories
Critical VDE-2025-054 4 CVEs

Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware

Published Jul 8, 2025 · Updated Jul 8, 2025

Vendor: Phoenix Contact Product: AXC F 1152 Product: AXC F 2152 Product: AXC F 3152 Product: BPC 9102S Product: RFC 4072S

Summary

Multiple vulnerabilities in the PLCnext system allowed low-privileged remote attackers to gain unauthorized access or trigger system reboots by manipulating configuration files and symbolic links. Affected services include watchdog, arp-preinit, and security-profile, potentially exposing critical system files. These issues have been resolved in firmware version 2025.0.2.

Details

Impact
Availability, integrity, or confidentiality of the PLCnext Control might be compromised by attacks using these vulnerabilities.

Remediation
Update to the latest 2025.0.2 Firmware Release. PHOENIX CONTACT recommends to always use an up-to-date version of the PLCnext Engineer.

Vulnerabilities 4

  • High 8.8
    CVE-2025-41666

    Phoenix Contact: File access due to the replacement of a critical file used by the watchdog

    A low privileged remote attacker with file access can replace a critical file used by the watchdog to get read, write and execute access to any file on the device after the watchdog has been initialized.

    Phoenix Contact AXC F 1152 AXC F 3152 RFC 4072S ICS / OT
  • High 8.8
    CVE-2025-41667

    Phoenix Contact: File access due to the replacement of a critical file used by the arp-preinit script

    A low privileged remote attacker with file access can replace a critical file used by the arp-preinit script to get read, write and execute access to any file on the device.

    Phoenix Contact AXC F 1152 AXC F 3152 RFC 4072S ICS / OT
  • High 8.8
    CVE-2025-41668

    Phoenix Contact: File access due to the replacement of a critical file used by the service security-profile

    A low privileged remote attacker with file access can replace a critical file or folder used by the service security-profile to get read, write and execute access to any file on the device.

    Phoenix Contact AXC F 1152 AXC F 3152 RFC 4072S ICS / OT
  • Medium 6.5
    CVE-2025-41665

    Phoenix Contact: DoS of the PLC due to incorrect default permissions possible

    An low privileged remote attacker can enforce the watchdog of the affected devices to reboot the PLC due to incorrect default permissions of a config file.

    Phoenix Contact AXC F 1152 AXC F 3152 RFC 4072S ICS / OT

Revision history

  1. #1

    Initial

References