Skip to content
OpenAdvisories
High VDE-2026-023 2 CVEs

Phoenix Contact: Several products are affected by vulnerabilities found in OpenSSL

Published Apr 22, 2026 · Updated Apr 22, 2026

Vendor: OpenSSL Software Foundation Vendor: Phoenix Contact Product: 3.0.19 Product: AXC F 1152 Product: AXC F 2000 EA Product: AXC F 2152 Product: AXC F 3152 Product: BPC 9102S Product: CATAN C1 EN Product: CELLULINK 2401-4G EU M25 Product: CELLULINK 2401-4G EU M40 Product: CELLULINK 4401-4G GL M25 Product: CELLULINK 4401-4G GL M40 Product: CHARX SEC-3000 Product: CHARX SEC-3050 Product: CHARX SEC-3100 Product: CHARX SEC-3150 Product: CLOUD CLIENT 1101T-TX/TX Product: ENERGY AXC PU Product: FL MGUARD 2102 Product: FL MGUARD 2105 Product: FL MGUARD 4102 PCI Product: FL MGUARD 4102 PCI/K2 Product: FL MGUARD 4102 PCIE Product: FL MGUARD 4102 PCIE/K2 Product: FL MGUARD 4302 Product: FL MGUARD 4302/K1 Product: FL MGUARD 4302/K2 Product: FL MGUARD 4302/K3 Product: FL MGUARD 4302/K4 +117 more

Summary

Attacks are possible when installing key files and digitally signed objects. These attacks can only be carried out if these files are uploaded and installed by a logged-in user with high privileges.

Details

Impact
A successful attack using manipulated firmware or key files (PKCS#12) can lead to the execution of malicious code. This can jeopardize confidentiality, integrity and availability.

Mitigation
Phoenix Contact strongly recommends to upload firmware or key files (PKCS#12) only from trusted source and to thorougly check the SHA256 checksum of the files to be uploaded.

Remediation
Phoenix Contact strongly recommends to upgrade affected devices to the fixed firmware as soon as it gets avaliable.

| Article family | Versionsnummer des Fix | Fix available | Planned release date |
|:----------------------------------------------------------------|:---------------------------|:----------------|:-----------------------|
| CHARX control modular SEC-3XXX | 1.9.0 | yes | |
| PLCnext Control | 2024.0.17 | yes | |
| PLCnext Control AXC F 2000 EA | 2026.0.0 | yes | |
| Energy AXC PU | V04.27.00.00 | no | 2026-08-31 |
| SMART RTU AXC SG | V01.11.00.00 | no | 2026-09-30 |
| SMART RTU AXC IG | V01.04.00.00 | no | 2026-12-31 |
| ILC 2250, CATAN C1 | Emalytics-1.12.3 | no | 2026-05-31 |
| ILC 2050 | Emalytics-1.12.4 | no | 2026-09-30 |
| FL MGUARD 2xxx, 4xxx | 10.6.1 | yes | |
| FL SWITCH 2xxx, FL NAT 2xxx, FL SWITCH TSN 23xx, FL SWITCH 59xx | 3.57 | no | 2026-06-29 |
| FL WLAN 1xxx, FL WLAN 23xx | 26.06.00 | no | 2026-06-29 |
| TC ROUTER 2xxx, 3xxx, TC CLOUD CLIENT 1002-4G | 3.8.9 | yes | |
| TC ROUTER 5004T-5G EU | 1.6.24 | yes | |
| CLOUD CLIENT 1101-TX/TX, TC CLOUD CLIENT 1002-TX/TX | 3.7.8 | yes | |
| TC ROUTER 4xxx | 5.0.72.102 | no | 2026-04-30 |
| FL TIMESERVER NTP | 5.0.71.101 | no | 2026-08-31 |
| CELLULINK x401-4G | 2025.6.3 | yes | |

Product Description
Phoenix Contact industrial routers, acess points and switches, security appliances, charge controllers and SPS controllers.

Vulnerabilities 2

  • High 8.8
    CVE-2025-15467 Public exploit EPSS 75%

    Stack buffer overflow in CMS (Auth)EnvelopedData parsing

    Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote c…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.4
    CVE-2025-69419 Public exploit

    Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion

    Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before the allocated buffer. Impact summary: The out-of-…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Revision history

  1. #1.0.0

    Initial release.

References