Description
An unauthenticated remote attacker can trick a high privileged user into uploading a malicious payload via the config-upload endpoint, leading to code injection as root. This results in a total loss of confidentiality, availability and integrity due to improper control of code generation ('Code Injection’).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Phoenix Contact | TC ROUTER 3002T-3G | 0.0.0 – < 3.08.8 | 3.08.8 |
| Phoenix Contact | TC ROUTER 2002T-3G | 0.0.0 – < 3.08.8 | 3.08.8 |
| Phoenix Contact | TC ROUTER 3002T-4G | 0.0.0 – < 3.08.8 | 3.08.8 |
| Phoenix Contact | TC ROUTER 3002T-4G GL | 0.0.0 – < 3.08.8 | 3.08.8 |
| Phoenix Contact | TC ROUTER 5004T-5G EU | 0.0.0 – < 1.06.23 | 1.06.23 |
| Phoenix Contact | TC ROUTER 3002T-4G VZW | 0.0.0 – < 3.08.8 | 3.08.8 |
| Phoenix Contact | TC ROUTER 3002T-4G ATT | 0.0.0 – < 3.08.8 | 3.08.8 |
| Phoenix Contact | TC ROUTER 2002T-4G | 0.0.0 – < 3.08.8 | 3.08.8 |
| Phoenix Contact | CLOUD CLIENT 1101T-TX/TX | 0.0.0 – < 3.07.7 | 3.07.7 |
| Phoenix Contact | TC CLOUD CLIENT 1002-4G ATT | 0.0.0 – < 3.08.8 | 3.08.8 |
| Phoenix Contact | TC CLOUD CLIENT 1002-TX/TX | 0.0.0 – < 3.07.7 | 3.07.7 |
Advisories 2
- WID-SEC-2026-0067 Phoenix Contact TC ROUTER und TC CLOUD CLIENT: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten BSI CERT-Bund (WID) · Jan 13, 2026
- VDE-2025-073 Phoenix Contact: Security Advisory for TC ROUTER and CLOUD CLIENT Industrial mobile network routers CERT@VDE · Jan 13, 2026