EPC 1502 at a glance
- Last 12 months
- 3
- Critical · all time
- 1
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 3 | 1 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Latest advisories
-
Critical max 9.8VDE-2025-056 3 CVEs
Phoenix Contact: Improper Input Validation Vulnerabilities in PLCnext Firmware
This advisory addresses multiple security vulnerabilities in PLCnext firmware versions prior to 2026.0.3. The vulnerabilities may allow unauthenticated attackers to cause denial of service, trigger unexpected system behavior, or execute unauthorized SQL queri…
-
Critical max 8.8
Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware
Multiple Linux component vulnerabilities fixed in latest PLCnext Firmware release 2024.0.6 LTS
first Dec 9, 2024 -
Critical max 9.8
Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware
Multiple Linux component vulnerabilities fixed in latest PLCnext Firmware release 2024.0.6 LTS
first Dec 9, 2024 -
High max 6.5
Phoenix Contact: PLCnext Control prone to download of code without integrity check
PLCnext Control provides authentication and integrity check for the application.An authenticated, skilled attacker might be able to manipulate the application (e.g.: logic files, executable logic, configurations) in a special crafted way that the integrity ch…
first Dec 12, 2023 -
High max 8.8
Phoenix Contact: PLCnext prone to Incorrect Permission Assignment for Critical Resource
PLCnext Control provides authentication and integrity check for the application.An authenticated, skilled attacker might be able to manipulate the application (e.g.: logic files, executable logic, configurations) in a special crafted way that the integrity ch…
first Dec 12, 2023
5 results · Feed
-
Medium 4.3
SQL injection
An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limit…
-
High 7.5
Unauthenticated Denial of Service
An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an remote attacker to interrupt access via the client application. Successful exploitation prevents communication until the PLCnext service is ma…
-
Critical 9.8
Unauthenticated Buffer Overflow in PROFINET Service
The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default configuration. An unauthenticated remote attacker could exploit this vulnerability to reboot the device or execute arbitrary code.
-
Medium 6.5
PHOENIX CONTACT: PLCnext Control prone to download of code without integrity check
A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with low privileges to compromise integrity on the affected engineering station and the connected devices.
-
High 8.8
PHOENIX CONTACT: Insufficient Read and Write Protection to Logic and Runtime Data in PLCnext Control
A incorrect permission assignment for critical resource vulnerability in PLCnext products allows an remote attacker with low privileges to gain full access on the affected devices.