Skip to content
OpenAdvisories
Critical VDE-2025-056 3 CVEs

Phoenix Contact: Improper Input Validation Vulnerabilities in PLCnext Firmware

Published Aug 12, 2026 · Updated Aug 12, 2026

Vendor: Phoenix Contact Product: AXC F 1152 Product: AXC F 1252 Product: AXC F 2000 EA Product: AXC F 2152 Product: AXC F 3152 Product: BPC 9102S Product: BPC 9202S Product: Catan C1 Product: EPC 1502 Product: EPC 1522 Product: RFC 4072R Product: RFC 4072S Product: VL3 UPC 2440 EDGE Product: VPLCNEXT CONTROL 1000 Product: VPLCNEXT CONTROL 2000 Product: VPLCNEXT CONTROL 3000 Product: VPLCNEXT CONTROL 500

Summary

This advisory addresses multiple security vulnerabilities in PLCnext firmware versions prior to 2026.0.3. The vulnerabilities may allow unauthenticated attackers to cause denial of service, trigger unexpected system behavior, or execute unauthorized SQL queries. Successful exploitation could impact the availability, integrity, and confidentiality of affected PLCnext Control devices. All issues are resolved in PLCnext firmware version 2026.0.3.

Details

Impact
The reported vulnerabilities allow an unauthenticated remote attacker to cause a denial-of-service condition, trigger unexpected behaviour through a buffer overflow, or execute unauthorized SQL queries against affected PLCnext devices. Successful exploitation could impact the availability, integrity, and confidentiality of the system.

Remediation
Phoenix Contact recommends updating affected devices to PLCnext firmware version 2026.0.3 or later, which addresses all vulnerabilities described in this advisory.

Vulnerabilities 3

  • Critical 9.8
    CVE-2025-41769

    Unauthenticated Buffer Overflow in PROFINET Service

    The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default configuration. An unauthenticated remote attacker could exploit this vulnerability to reboot the device or execute arbitrary code.

    Phoenix Contact AXC F 1152 AXC F 3152 RFC 4072S Browsers ICS / OT
  • High 7.5
    CVE-2025-41770

    Unauthenticated Denial of Service

    An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an remote attacker to interrupt access via the client application. Successful exploitation prevents communication until the PLCnext service is ma…

    Phoenix Contact RFC 4072S AXC F 2152 BPC 9102S Browsers ICS / OT
  • Medium 4.3
    CVE-2025-41771

    SQL injection

    An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limit…

    Phoenix Contact AXC F 1152 AXC F 3152 RFC 4072S Browsers ICS / OT

Revision history

  1. #1.0.0

    Initial

References