CVE-2025-41669: AXC F 1152 0.0.0 to before 2026.0.3; +13 more affected products

Affected technology

AXC F 1152 · 0.0.0 to before 2026.0.3
Phoenix Contact

AXC F 1252 · 0.0.0 to before 2026.0.3
Phoenix Contact

AXC F 2000 EA · 0.0.0 to before 2026.0.3
Phoenix Contact

AXC F 2152 · 0.0.0 to before 2026.0.3
Phoenix Contact

AXC F 3152 · 0.0.0 to before 2026.0.3
Phoenix Contact

BPC 9102S · 0.0.0 to before 2026.0.3
Phoenix Contact

EPC 1522 · 0.0.0 to before 2026.0.3
Phoenix Contact

RFC 4072R · 0.0.0 to before 2026.0.3
Phoenix Contact

RFC 4072S · 0.0.0 to before 2026.0.3
Phoenix Contact

VL3 UPC 2440 EDGE · 0.0.0 to before 2026.0.3
Phoenix Contact

VPLCNEXT CONTROL 1000 · 0.0.0 to before 2026.0.3
Phoenix Contact

VPLCNEXT CONTROL 2000 · 0.0.0 to before 2026.0.3
Phoenix Contact

VPLCNEXT CONTROL 3000 · 0.0.0 to before 2026.0.3
Phoenix Contact

VPLCNEXT CONTROL 500 · 0.0.0 to before 2026.0.3
Phoenix Contact

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

A remote low privileged Engineer user can install additional APPs on the device downloaded from the PLCnext Store without implementing any data verification mechanism, leading to the capability for an Engineer user to reach arbitrary code execution with root privileges on the PLC device. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality, integrity and availability impact as high.