Vendor
Phoenix Contact
193 known vulnerabilities.
Products
193 results · Feed
-
High 7.8
Local Privilege Escalation via Network scripts
A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.
-
High 8.6
Fallback to second RAUC slot with default credentials
An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including default credentials. This could allow the attacker to gain SSH access to the system as an unprivileged user "user-app". Cha…
-
High 7.8
Local Privilege Escalation vulnerability in /etc/init.d/user-applications via user-application start script
A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.
-
Critical 9.1
Missing input validation / stripping of CRLF characters in SystemConfigManager
An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss.
-
Critical 9.1
Creation of a new configuration by posting a malicious ID to MQTT
An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system configuration. This may lead to integrity and availability loss.
-
Critical 9.8
Missing authentication for MQTT Broker
Due to missing authentication, an unauthenticated remote attacker may access the MQTT broker, which is only protected from external access by a firewall. This may lead to the device being fully compromised.
-
High 7.5
Phoenix Contact: Unauthenticated log download vulnerability in the firmware of CHARX SEC-3xxx charging controllers
It is possible for an unauthenticated adjacent attacker to download log files of the controller, which may disclose some restricted information.
-
High 8.8
Insufficient Verification of Data Authenticity
The Web-based Management allows a remote low privileged Engineer user to install additional APPs on the device downloaded from the PLCnext Store without implementing any data verification mechanism, leading to the capability for an Engineer user to reach arbi…
-
High 7.8
Untrusted Search Path
A local user with low privileges may be able to influence the behavior of a privileged system service by manipulating configuration or application-related files located in user-writable areas of the filesystem. The affected service processes data from locatio…
-
High 8.0
Phoenix Contact: Improper removal of sensitive information in MGUARD products
A low privileged remote attacker can gain the root password due to improper removal of sensitive information before storage or transfer.
-
High 7.1
Cross‑Site Request Forgery in Link Aggregation Configuration
A CSRF vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker to trick authenticated users into sending unauthorized POST requests to the device by luring them to a malicious webpage. This can silently alter th…
-
High 7.1
Stored Cross‑Site Scripting in Link Aggregation Name Handling
A stored cross‑site scripting (XSS) vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker to create a trunk entry containing malicious HTML/JavaScript code. When the affected page is viewed, the injected scrip…
-
Medium 5.3
Stack-Based Buffer Overflow in CLI Login Username Handling over CLI
A stack-based buffer overflow in the device's Telnet/SSH CLI login routine occurs when a unauthenticated attacker send an oversized or unexpected username input. An overflow condition crashes the thread handling the login attempt, forcing the session to close…
-
Medium 6.5
Stack-Based Buffer Overflow in TFTP File-Transfer Command Handling over CLI
A stack-based buffer overflow in the CLI's TFTP file‑transfer command handling allows a low-privileged attacker with Telnet/SSH access to trigger memory corruption by supplying unexpected or oversized filename input. Exploitation results in the corruption of …
-
Medium 4.9
Stack-Based Buffer Overflow in File Install Parameter Handling
A stack-based buffer overflow in the device's file installation workflow allows a high-privileged attacker to send oversized POST parameters that overflow a fixed-size stack buffer within an internal process, resulting in a DoS attack.
-
Medium 4.9
Stack-Based Buffer Overflow in File Transfer Parameter Handling
A stack-based buffer overflow vulnerability in the device's file transfer parameter workflow allows a high-privileged attacker to send oversized POST parameters, causing memory corruption in an internal process, resulting in a DoS attack.
-
High 7.2
Command Injection Vulnerability in Root CA Certificate Transfer Workflow
A command injection vulnerability in the device’s Root CA certificate transfer workflow allows a high-privileged attacker to send crafted HTTP POST requests that result in arbitrary command execution on the underlying Linux OS with root privileges.
-
Medium 6.5
Buffer Overflow using TFTP Filename
A remote attacker with user privileges for the webUI can use the setting of the TFTP Filename with a POST Request to trigger a stack-based Buffer Overflow, resulting in a DoS attack.
-
High 8.8
Config-Upload Code Injection
An unauthenticated remote attacker can trick a high privileged user into uploading a malicious payload via the config-upload endpoint, leading to code injection as root. This results in a total loss of confidentiality, availability and integrity due to improp…
-
Medium 4.3
Authenticated Denial-of-Service via SSH
A low privileged remote attacker can use the ssh feature to execute commands directly after login. The process stays open and uses resources which leads to a reduced performance of the management functions. Switching functionality is not affected.
-
Medium 4.6
Hardcoded User Password
An attacker can use an undocumented UART port on the PCB as a side-channel with the user hardcoded credentials obtained from CVE-2025-41692 to gain read access to parts of the filesystem of the device.
-
Medium 6.5
Authenticated Denial-of-Service via Webshell
A low privileged remote attacker can run the webshell with an empty command containing whitespace. The server will then block until it receives more data, resulting in a DoS condition of the websserver.
-
Medium 6.8
Weak/Predictable root Password
A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak password generation algorithm.
-
Medium 6.8
Shell access to UART Console
An attacker can use an undocumented UART port on the PCB as a side-channel to get root access e.g. with the credentials obtained from CVE-2025-41692.
-
High 7.1
Reflected XSS vulnerability in dyn_conn.php
An XSS vulnerability in dyn_conn.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerability do…
-
High 7.1
Reflected XSS vulnerability in pxc_portCntr2.php
An XSS vulnerability in pxc_portCntr2.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerabili…
-
High 7.1CVE-2025-41746 EPSS 10%
Reflected XSS vulnerability in pxc_portSecCfg.php
An XSS vulnerability in pxc_portSecCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerabil…
-
High 7.1CVE-2025-41747 EPSS 10%
Reflected XSS vulnerability in pxc_vlanIntfCfg.php
An XSS vulnerability in pxc_vlanIntfCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerabi…
-
High 7.1CVE-2025-41748 EPSS 10%
Reflected XSS vulnerability in pxc_Dot1xCfg.php
An XSS vulnerability in pxc_Dot1xCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability d…
-
High 7.1
Reflected XSS vulnerability in port_util.php
An XSS vulnerability in port_util.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does…
-
High 7.1CVE-2025-41750 EPSS 10%
Reflected XSS vulnerability in pxc_PortCfg.php
An XSS vulnerability in pxc_PortCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability do…
-
High 7.1CVE-2025-41751 EPSS 10%
Reflected XSS vulnerability in pxc_portCntr.php
An XSS vulnerability in pxc_portCntr.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability d…
-
High 7.1CVE-2025-41752 EPSS 10%
Reflected XSS vulnerability in pxc_portSfp.php
An XSS vulnerability in pxc_portSfp.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability do…
-
High 8.8
Phoenix Contact: Security Advisory for CHARX SEC-3xxx charging controllers
An low privileged remote attacker with an account for the Web-based management can change the system configuration to perform a command injection as root, resulting in a total loss of confidentiality, availability and integrity due to improper control of gene…
-
Medium 5.3
Phoenix Contact: WebSocket Handler Denial of Service
The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the issue without affecting the core functionality.
-
Medium 5.3
Phoenix Contact: Webserver Denial of Service through Malformed Content-Length
The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-length to trigger the issue without affecting the core functionality.
-
Medium 6.8
Phoenix Contact: WebSocket Message Interception Leaks Webfrontend Credentials
An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend.
-
Medium 5.3
Phoenix Contact: Unauthenticated Modbus Service DoS via Crafted Function Code
An unauthanticated remote attacker can perform a DoS of the Modbus service by sending a specific function and sub-function code without affecting the core functionality.
-
High 7.5
Phoenix Contact: UPS Shutdown via Unauthenticated Modbus Command
An unauthenticated remote attacker can cause a Denial of Service by turning off the output of the UPS via Modbus command.
-
High 7.8
Improper File Permissions Allow Local Privilege Escalation
A low-privileged local attacker can exploit improper permissions on nssm.exe to escalate their privileges and gain administrative access.