Skip to content
OpenAdvisories
High VDE-2026-050 2 CVEs

Phoenix Contact: PLCnext Firmware Security Issues Related to APPs and Configuration Files

Published May 27, 2026 · Updated May 27, 2026

Vendor: Phoenix Contact Product: AXC F 1152 Product: AXC F 1252 Product: AXC F 2000 EA Product: AXC F 2152 Product: AXC F 3152 Product: BPC 9102S Product: EPC 1522 Product: RFC 4072R Product: RFC 4072S Product: VL3 UPC 2440 EDGE Product: VPLCNEXT CONTROL 1000 Product: VPLCNEXT CONTROL 2000 Product: VPLCNEXT CONTROL 3000 Product: VPLCNEXT CONTROL 500

Summary

This advisory addresses security issues in PLCnext firmware versions prior to 2026.0.3 that are related to APP handling and the processing of configuration files. The identified vulnerabilities affect APP installation authenticity as well as the handling of configuration data in writable directories. Successful exploitation may allow authenticated attackers with different privilege levels to compromise integrity, availability, and system security of affected PLCnext Control. Both issues are resolved starting with PLCnext firmware version 2026.0.3.

Details

Impact
Depending on the vulnerability exploited, an attacker may be able to install manipulated APPs, influence the execution of privileged services through crafted configuration files, or execute unauthorized code with elevated permissions. This may lead to a compromise of integrity and availability of the PLCnext Control. Attack vectors include network-based access via the Web-based Management interface as well as local access by authenticated low-privileged users.

Remediation
Phoenix Contact recommends updating affected devices to PLCnext firmware version 2026.0.3 or later, which addresses all vulnerabilities described in this advisory. If immediate updates are not possible, refer to the CVE-specific mitigation measures described below.

Mitigation
The following mitigation measures are recommended. Depending on the operational environment, one or more of these measures may be applied to reduce risk:

- Install APPs only from trusted sources and manually verify the SHA-256 checksum of the downloaded APP file before installation.
- Restrict access to the Web-based Management interface to authorized users only.
- Use firewall configuration to limit access to management interfaces and required services. Firewall configuration should be used to limit network communication to required services and to supervise execution behavior.
- Protect Engineer credentials and apply strong authentication practices.
- If APP functionality is not required for operation, consider disabling the APP Manager to reduce the attack surface.
- Exploitation of CVE-2025-41670 requires local access to the device; therefore, local access should be restricted to authorized and trusted users only. The device should be operated in a secured and controlled environment to prevent unauthorized local access.
- Enable system wide Syslog Server and check local security notifications to detect unexpected APP installation, execution behavior or abnormal system activity.
- Apply the latest firmware and security updates provided by the vendor

Vulnerabilities 2

  • High 8.8
    CVE-2025-41669

    Insufficient Verification of Data Authenticity

    The Web-based Management allows a remote low privileged Engineer user to install additional APPs on the device downloaded from the PLCnext Store without implementing any data verification mechanism, leading to the capability for an Engineer user to reach arbi…

    Phoenix Contact BPC 9102S AXC F 1152 AXC F 3152 Browsers ICS / OT
  • High 7.8
    CVE-2025-41670

    Untrusted Search Path

    A local user with low privileges may be able to influence the behavior of a privileged system service by manipulating configuration or application-related files located in user-writable areas of the filesystem. The affected service processes data from locatio…

    Phoenix Contact RFC 4072S AXC F 2152 BPC 9102S Browsers ICS / OT

Revision history

  1. #1.0.0

    Initial

References