CVE-2025-41669
highpriority · track · 0EPSS 0.002 · 12 %ileDEEUEPSS · scored 2026-10-27
The Web-based Management allows a remote low privileged Engineer user to install additional APPs on the device downloaded from the PLCnext Store without implementing any data verification mechanism, leading to the capability for an Engineer user to reach arbitrary code execution with root privileges on the PLC device. A successful exploitation may allow to install a manipulated APP package, potentially impacting integrity and availability of the PLCnext Control.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedphoenix_contact_psirt
Update to PLCnext firmware version 2026.0.3 or later where APP signature verification is enforced by default. Check regularly for firmware updates and apply them as soon as they are available for the specific device.
- Mitigationphoenix_contact_psirt
For firmware versions prior to 2026.0.3 apps are installed via WBM (APP Manager) without enforced authenticity validation. Verify the SHA-256 checksum provided by the PLCnext Store manually before installing an APP. Restrict WBM access to trusted IP ranges via the firewall and protect Engineer credentials. Monitor APP lifecycle security notifications locally or via a central Syslog server. If APPs are not required, disable the APP Manager service via the WBM System Services page to eliminate an unnecessary attack vector. Starting with firmware version 2026.0.3, APP signature verification is enabled by default and only signed apps can be installed.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.3–8.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (41)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- VDE-2026-050Phoenix Contact: PLCnext Firmware Security Issues Related to APPs and Configuration Files2026-05-27csaf · phoenix_contact_psirtDE
This advisory addresses security issues in PLCnext firmware versions prior to 2026.0.3 that are related to APP handling and the processing of configuration files. The identified vulnerabilities affect APP installation authenticity as well as the handling of configuration data in writable directories. Successful exploitation may allow authenticated attackers with different privilege levels to compromise integrity, availability, and system security of affected PLCnext Control. Both issues are resolved starting with PLCnext firmware version 2026.0.3.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (4)
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan