CVE-2025-41717

highPriorität · verfolgen · 0EPSS 0.006 · 46. PerzentilDEEU
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.55% (46th) EPSS
CVSS 8.8 · high
Is it mine?
55 products
Prüfe deine Angriffsfläche
Who says so?
4 sources
cnnvd · enisa_euvd · cert_bund · phoenix_contact_psirt

EPSS · bewertet 2026-10-27

An unauthenticated remote attacker can trick a high privileged user into uploading a malicious payload via the config-upload endpoint, leading to code injection as root. This results in a total loss of confidentiality, availability and integrity due to improper control of code generation ('Code Injection’).

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • BehobenFirmware <FW 1.06.23 installed on TC ROUTER 5004T-5G EUphoenix_contact_psirt

    Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |

  • BehobenFirmware <FW 3.07.7 installed on CLOUD CLIENT 1101T-TX/TXphoenix_contact_psirt

    Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |

  • BehobenFirmware <FW 3.07.7 installed on TC CLOUD CLIENT 1002-TX/TXphoenix_contact_psirt

    Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |

  • BehobenFirmware <FW 3.08.8 installed on TC CLOUD CLIENT 1002-4G ATTphoenix_contact_psirt

    Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |

  • BehobenFirmware <FW 3.08.8 installed on TC ROUTER 2002T-3Gphoenix_contact_psirt

    Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |

  • BehobenFirmware <FW 3.08.8 installed on TC ROUTER 2002T-4Gphoenix_contact_psirt

    Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |

  • BehobenFirmware <FW 3.08.8 installed on TC ROUTER 3002T-3Gphoenix_contact_psirt

    Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |

  • BehobenFirmware <FW 3.08.8 installed on TC ROUTER 3002T-4Gphoenix_contact_psirt

    Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |

  • BehobenFirmware <FW 3.08.8 installed on TC ROUTER 3002T-4G ATTphoenix_contact_psirt

    Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |

  • BehobenFirmware <FW 3.08.8 installed on TC ROUTER 3002T-4G GLphoenix_contact_psirt

    Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |

  • BehobenFirmware <FW 3.08.8 installed on TC ROUTER 3002T-4G VZWphoenix_contact_psirt

    Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |

  • MitigationFirmware <FW 1.06.23 installed on TC ROUTER 5004T-5G EUphoenix_contact_psirt

    As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.

  • MitigationFirmware <FW 3.07.7 installed on CLOUD CLIENT 1101T-TX/TXphoenix_contact_psirt

    As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.

  • MitigationFirmware <FW 3.07.7 installed on TC CLOUD CLIENT 1002-TX/TXphoenix_contact_psirt

    As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.

  • MitigationFirmware <FW 3.08.8 installed on TC CLOUD CLIENT 1002-4G ATTphoenix_contact_psirt

    As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.

  • MitigationFirmware <FW 3.08.8 installed on TC ROUTER 2002T-3Gphoenix_contact_psirt

    As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.

  • MitigationFirmware <FW 3.08.8 installed on TC ROUTER 2002T-4Gphoenix_contact_psirt

    As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.

  • MitigationFirmware <FW 3.08.8 installed on TC ROUTER 3002T-3Gphoenix_contact_psirt

    As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.

  • MitigationFirmware <FW 3.08.8 installed on TC ROUTER 3002T-4Gphoenix_contact_psirt

    As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.

  • MitigationFirmware <FW 3.08.8 installed on TC ROUTER 3002T-4G ATTphoenix_contact_psirt

    As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.

  • MitigationFirmware <FW 3.08.8 installed on TC ROUTER 3002T-4G GLphoenix_contact_psirt

    As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.

  • MitigationFirmware <FW 3.08.8 installed on TC ROUTER 3002T-4G VZWphoenix_contact_psirt

    As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.8
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · ENISA EU
v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · info@cert.vde.comAusnutzbarkeit 2.8 · Auswirkung 5.9
v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · Phoenix Contact PSIRT DE
v3.18.1highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
03

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
04

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-94USCWE-94US
05

betroffene Produkte (55)

Betroffene Produkte und Versionsbereiche.

20 von 55 angezeigt
06

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

  • VDE-2025-073Phoenix Contact: Security Advisory for TC ROUTER and CLOUD CLIENT Industrial mobile network routers2026-01-13csaf · phoenix_contact_psirtDE

    A code injection vulnerability at the upload-config endpoint in the firmware of TC ROUTER and CLOUD CLIENT Industrial Mobile network routers has been discovered that can be exploited by an high privileged attacker.

  • WID-SEC-W-2026-0067Phoenix Contact TC ROUTER und TC CLOUD CLIENT: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit AdministratorrechtenDeutsch2026-01-12csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Phoenix Contact TC ROUTER und TC CLOUD CLIENT Geräten ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen.

07

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

08

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdcert_bundphoenix_contact_psirtNVDCVE.orgMITRE
veröffentlicht 2026-01-13geändert 2026-06-17
09

Referenzen (5)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan