Description
A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with low privileges to compromise integrity on the affected engineering station and the connected devices.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| PHOENIX CONTACT | AXC F 1152 | ≤ 2024.0 | — |
| PHOENIX CONTACT | AXC F 2152 | ≤ 2024.0 | — |
| PHOENIX CONTACT | AXC F 3152 | ≤ 2024.0 | — |
| PHOENIX CONTACT | BPC 9102S | ≤ 2024.0 | — |
| PHOENIX CONTACT | EPC 1502 | ≤ 2024.0 | — |
| PHOENIX CONTACT | EPC 1522 | ≤ 2024.0 | — |
| PHOENIX CONTACT | PLCnext Engineer | ≤ 2024.0 | — |
| PHOENIX CONTACT | RFC 4072R | ≤ 2024.0 | — |
| PHOENIX CONTACT | RFC 4072S | ≤ 2024.0 | — |
Advisories 1
- VDE-2023-058 Phoenix Contact: PLCnext Control prone to download of code without integrity check CERT@VDE · May 22, 2025