Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware
Multiple vulnerabilities in the PLCnext system allowed low-privileged remote attackers to gain unauthorized access or trigger system reboots by manipulating configuration files and symbolic links. Affected services include watchdog, arp-preinit, and security-profile, potentially exposing critical system files. These issues have been resolved in firmware version 2025.0.2.
beschreibt (4)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-41668US | — | — | ||
A low privileged remote attacker with file access can replace a critical file or folder used by the service security-profile to get read, write and execute access to any file on th… | ||||
| CVE-2025-41667US | — | — | ||
A low privileged remote attacker with file access can replace a critical file used by the arp-preinit script to get read, write and execute access to any file on the device. | ||||
| CVE-2025-41666US | — | — | ||
A low privileged remote attacker with file access can replace a critical file used by the watchdog to get read, write and execute access to any file on the device after the watchdo… | ||||
| CVE-2025-41665US | —OT erhöht | — | ||
An low privileged remote attacker can enforce the watchdog of the affected devices to reboot the PLC due to incorrect default permissions of a config file. | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (20)
- BehobenAXC F 1152
Phoenix Contact strongly recommends to upgrade to firmware 2025.02 which addresses this vulnerability and will be available for download for all affected devices within the next weeks.
- BehobenAXC F 1152
Phoenix Contact strongly recommends to upgrade to firmware 2025.02 which addresses this vulnerability and will be available for download for all affected devices within the next weeks.
- BehobenAXC F 1152
Phoenix Contact strongly recommends to upgrade to firmware 2025.02 which addresses this vulnerability and will be available for download for all affected devices within the next weeks.
- BehobenAXC F 1152
Phoenix Contact strongly recommends to upgrade to firmware 2025.02 which addresses this vulnerability and will be available for download for all affected devices within the next weeks.
- BehobenAXC F 2152
Phoenix Contact strongly recommends to upgrade to firmware 2025.02 which addresses this vulnerability and will be available for download for all affected devices within the next weeks.
- BehobenAXC F 2152
Phoenix Contact strongly recommends to upgrade to firmware 2025.02 which addresses this vulnerability and will be available for download for all affected devices within the next weeks.
- BehobenAXC F 2152
Phoenix Contact strongly recommends to upgrade to firmware 2025.02 which addresses this vulnerability and will be available for download for all affected devices within the next weeks.
- BehobenAXC F 2152
Phoenix Contact strongly recommends to upgrade to firmware 2025.02 which addresses this vulnerability and will be available for download for all affected devices within the next weeks.
- BehobenAXC F 3152
Phoenix Contact strongly recommends to upgrade to firmware 2025.02 which addresses this vulnerability and will be available for download for all affected devices within the next weeks.
- BehobenAXC F 3152
Phoenix Contact strongly recommends to upgrade to firmware 2025.02 which addresses this vulnerability and will be available for download for all affected devices within the next weeks.
- BehobenAXC F 3152
Phoenix Contact strongly recommends to upgrade to firmware 2025.02 which addresses this vulnerability and will be available for download for all affected devices within the next weeks.
- BehobenAXC F 3152
Phoenix Contact strongly recommends to upgrade to firmware 2025.02 which addresses this vulnerability and will be available for download for all affected devices within the next weeks.
- BehobenBPC 9102S
Phoenix Contact strongly recommends to upgrade to firmware 2025.02 which addresses this vulnerability and will be available for download for all affected devices within the next weeks.
- BehobenBPC 9102S
Phoenix Contact strongly recommends to upgrade to firmware 2025.02 which addresses this vulnerability and will be available for download for all affected devices within the next weeks.
- BehobenBPC 9102S
Phoenix Contact strongly recommends to upgrade to firmware 2025.02 which addresses this vulnerability and will be available for download for all affected devices within the next weeks.
- BehobenBPC 9102S
Phoenix Contact strongly recommends to upgrade to firmware 2025.02 which addresses this vulnerability and will be available for download for all affected devices within the next weeks.
- BehobenRFC 4072S
Phoenix Contact strongly recommends to upgrade to firmware 2025.02 which addresses this vulnerability and will be available for download for all affected devices within the next weeks.
- BehobenRFC 4072S
Phoenix Contact strongly recommends to upgrade to firmware 2025.02 which addresses this vulnerability and will be available for download for all affected devices within the next weeks.
- BehobenRFC 4072S
Phoenix Contact strongly recommends to upgrade to firmware 2025.02 which addresses this vulnerability and will be available for download for all affected devices within the next weeks.
- BehobenRFC 4072S
Phoenix Contact strongly recommends to upgrade to firmware 2025.02 which addresses this vulnerability and will be available for download for all affected devices within the next weeks.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan