Phoenix Contact: Security Advisory for TC ROUTER and CLOUD CLIENT Industrial mobile network routers
A code injection vulnerability at the upload-config endpoint in the firmware of TC ROUTER and CLOUD CLIENT Industrial Mobile network routers has been discovered that can be exploited by an high privileged attacker.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-41717US | — | — | ||
An unauthenticated remote attacker can trick a high privileged user into uploading a malicious payload via the config-upload endpoint, leading to code injection as root. This resul… | ||||
references
External citations — patches, advisories, analysis.
- Phoenix Contact advisory overview at CERT@VDEexternal
- VDE-2025-073: Phoenix Contact: Security Advisory for TC ROUTER and CLOUD CLIENT Industrial mobile network routers - HTMLself
- Phoenix Contact application noteexternal
- PCSA-2025-00014external
- VDE-2025-073: Phoenix Contact: Security Advisory for TC ROUTER and CLOUD CLIENT Industrial mobile network routers - CSAFself
remediations (22)
- MitigationFirmware <FW 1.06.23 installed on TC ROUTER 5004T-5G EU
As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.
- MitigationFirmware <FW 3.07.7 installed on CLOUD CLIENT 1101T-TX/TX
As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.
- MitigationFirmware <FW 3.07.7 installed on TC CLOUD CLIENT 1002-TX/TX
As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.
- MitigationFirmware <FW 3.08.8 installed on TC CLOUD CLIENT 1002-4G ATT
As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.
- MitigationFirmware <FW 3.08.8 installed on TC ROUTER 2002T-3G
As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.
- MitigationFirmware <FW 3.08.8 installed on TC ROUTER 2002T-4G
As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.
- MitigationFirmware <FW 3.08.8 installed on TC ROUTER 3002T-3G
As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.
- MitigationFirmware <FW 3.08.8 installed on TC ROUTER 3002T-4G
As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.
- MitigationFirmware <FW 3.08.8 installed on TC ROUTER 3002T-4G ATT
As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.
- MitigationFirmware <FW 3.08.8 installed on TC ROUTER 3002T-4G GL
As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.
- MitigationFirmware <FW 3.08.8 installed on TC ROUTER 3002T-4G VZW
As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.
- FixedFirmware <FW 1.06.23 installed on TC ROUTER 5004T-5G EU
Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |
- FixedFirmware <FW 3.07.7 installed on CLOUD CLIENT 1101T-TX/TX
Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |
- FixedFirmware <FW 3.07.7 installed on TC CLOUD CLIENT 1002-TX/TX
Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |
- FixedFirmware <FW 3.08.8 installed on TC CLOUD CLIENT 1002-4G ATT
Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |
- FixedFirmware <FW 3.08.8 installed on TC ROUTER 2002T-3G
Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |
- FixedFirmware <FW 3.08.8 installed on TC ROUTER 2002T-4G
Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |
- FixedFirmware <FW 3.08.8 installed on TC ROUTER 3002T-3G
Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |
- FixedFirmware <FW 3.08.8 installed on TC ROUTER 3002T-4G
Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |
- FixedFirmware <FW 3.08.8 installed on TC ROUTER 3002T-4G ATT
Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |
- FixedFirmware <FW 3.08.8 installed on TC ROUTER 3002T-4G GL
Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |
- FixedFirmware <FW 3.08.8 installed on TC ROUTER 3002T-4G VZW
Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan