Phoenix Contact: Security Advisory for QUINT4-UPS EIP
Multiple vulnerabilities were discovered in the firmware of QUINT4-UPS EIP devices that can be used by an unauthenticated remote attacker to perform Denial of Service attacks and to gather login credentials for the Webfrontend.
describes (5)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-41707US | — | — | ||
The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the issue without affecting… | ||||
| CVE-2025-41706US | — | — | ||
The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-length to trigger the iss… | ||||
| CVE-2025-41705US | — | — | ||
An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend. | ||||
| CVE-2025-41704US | — | — | ||
An unauthanticated remote attacker can perform a DoS of the Modbus service by sending a specific function and sub-function code without affecting the core functionality. | ||||
| CVE-2025-41703US | —OT elevated | — | ||
An unauthenticated remote attacker can cause a Denial of Service by turning off the output of the UPS via Modbus command. | ||||
references
External citations — patches, advisories, analysis.
remediations (13)
- Mitigation
This product was designed for use in closed industrial networks. Phoenix Contact strongly recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our [application note](https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf).
- Mitigation
This product was designed for use in closed industrial networks. Phoenix Contact strongly recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our [application note](https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf).
- Mitigation
This product was designed for use in closed industrial networks. Phoenix Contact strongly recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our [application note](https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf).
- Mitigation
This product was designed for use in closed industrial networks. Phoenix Contact strongly recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our [application note](https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf).
- Mitigation
This product was designed for use in closed industrial networks. Phoenix Contact strongly recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our [application note](https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf). In the industrial sector it is common practice to use Modbus/TCP without authentication.
- No fix plannedQUINT4-UPS/24DC/24DC/10/EIP
Configuration via unauthenticated modbus commands is a commonly used feature in the industrial sector. It is necessary take appropriate steps in the application to limit modbus access to the device.
- No fix plannedQUINT4-UPS/24DC/24DC/20/EIP
Configuration via unauthenticated modbus commands is a commonly used feature in the industrial sector. It is necessary take appropriate steps in the application to limit modbus access to the device.
- No fix plannedQUINT4-UPS/24DC/24DC/40/EIP
Configuration via unauthenticated modbus commands is a commonly used feature in the industrial sector. It is necessary take appropriate steps in the application to limit modbus access to the device.
- No fix plannedQUINT4-UPS/24DC/24DC/5/EIP
Configuration via unauthenticated modbus commands is a commonly used feature in the industrial sector. It is necessary take appropriate steps in the application to limit modbus access to the device.
- Fixed
Starting with VC:07 the affected devices will be shipped with a fixed firmware.
- Fixed
Starting with VC:07 the affected devices will be shipped with a fixed firmware.
- Fixed
Starting with VC:07 the affected devices will be shipped with a fixed firmware.
- Fixed
Starting with VC:07 the affected devices will be shipped with a fixed firmware.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan