Summary
Multiple vulnerabilities were discovered in the firmware of QUINT4-UPS EIP devices that can be used by an unauthenticated remote attacker to perform Denial of Service attacks and to gather login credentials for the Webfrontend.
Details
Impact
A successful attack can lead to Denial of Service or exposure of credentials.
Mitigation
Affected devices are designed and developed for the use in closed industrial networks. Phoenix Contact therefore strongly recommends using the devices exclusively in closed networks and protected by a suitable firewall.
Remediation
Starting with version VC:07, all newly shipped devices will include firmware updates that address four vulnerabilities: CVE-2025-41704, CVE-2025-41705, CVE-2025-41706, and CVE-2025-41707.
However, configuration of devices via unauthenticated Modbus/TCP remains possible in VC:07, as this protocol is a widely used standard in the industrial sector. As a result, VC:07 is still affected by CVE-2025-41703.
Product description
Uninterruptible power supplies with an EIP interface.
Vulnerabilities 5
-
High 7.5
Phoenix Contact: UPS Shutdown via Unauthenticated Modbus Command
An unauthenticated remote attacker can cause a Denial of Service by turning off the output of the UPS via Modbus command.
-
Medium 6.8
Phoenix Contact: WebSocket Message Interception Leaks Webfrontend Credentials
An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend.
-
Medium 5.3
Phoenix Contact: Unauthenticated Modbus Service DoS via Crafted Function Code
An unauthanticated remote attacker can perform a DoS of the Modbus service by sending a specific function and sub-function code without affecting the core functionality.
-
Medium 5.3
Phoenix Contact: Webserver Denial of Service through Malformed Content-Length
The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-length to trigger the issue without affecting the core functionality.
-
Medium 5.3
Phoenix Contact: WebSocket Handler Denial of Service
The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the issue without affecting the core functionality.
Revision history
-
#1.0.0
Initial revision.
References
-
VDE-2025-072: Phoenix Contact: Security Advisory for QUINT4-UPS EIP - HTML
https://certvde.com/en/advisories/VDE-2025-072/
-
Phoenix Contact advisory overview at CERT@VDE
https://certvde.com/de/advisories/vendor/phoenixcontact/
-
PCSA-2025-00013
https://phoenixcontact.com/psirt