CVE-2025-41670: AXC F 1152 0.0.0 to before 2026.0.3; +13 more affected products

Affected technology

AXC F 1152 · 0.0.0 to before 2026.0.3
Phoenix Contact

AXC F 1252 · 0.0.0 to before 2026.0.3
Phoenix Contact

AXC F 2000 EA · 0.0.0 to before 2026.0.3
Phoenix Contact

AXC F 2152 · 0.0.0 to before 2026.0.3
Phoenix Contact

AXC F 3152 · 0.0.0 to before 2026.0.3
Phoenix Contact

BPC 9102S · 0.0.0 to before 2026.0.3
Phoenix Contact

EPC 1522 · 0.0.0 to before 2026.0.3
Phoenix Contact

RFC 4072R · 0.0.0 to before 2026.0.3
Phoenix Contact

RFC 4072S · 0.0.0 to before 2026.0.3
Phoenix Contact

VL3 UPC 2440 EDGE · 0.0.0 to before 2026.0.3
Phoenix Contact

VPLCNEXT CONTROL 1000 · 0.0.0 to before 2026.0.3
Phoenix Contact

VPLCNEXT CONTROL 2000 · 0.0.0 to before 2026.0.3
Phoenix Contact

VPLCNEXT CONTROL 3000 · 0.0.0 to before 2026.0.3
Phoenix Contact

VPLCNEXT CONTROL 500 · 0.0.0 to before 2026.0.3
Phoenix Contact

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

A local user with low privileges may be able to influence the behavior of a privileged system service by manipulating configuration or application-related files located in user-writable areas of the filesystem. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality, integrity and availability impact as high.