CVE-2025-41703

highpriority · track · 0OT risk · elevatedEPSS 0.011 · 64 %ileDEEU
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
1.05% (64th) EPSS
CVSS 7.5 · high
Is it mine?
20 products
Check your exposure
Who says so?
3 sources
cnnvd · enisa_euvd · phoenix_contact_psirt

EPSS · scored 2026-10-27

An unauthenticated remote attacker can cause a Denial of Service by turning off the output of the UPS via Modbus command.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

No vendor fix yet; a mitigation is available.

  • Mitigationphoenix_contact_psirt

    This product was designed for use in closed industrial networks. Phoenix Contact strongly recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our [application note](https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf). In the industrial sector it is common practice to use Modbus/TCP without authentication.

  • No fix plannedQUINT4-UPS/24DC/24DC/10/EIPphoenix_contact_psirt

    Configuration via unauthenticated modbus commands is a commonly used feature in the industrial sector. It is necessary take appropriate steps in the application to limit modbus access to the device.

  • No fix plannedQUINT4-UPS/24DC/24DC/20/EIPphoenix_contact_psirt

    Configuration via unauthenticated modbus commands is a commonly used feature in the industrial sector. It is necessary take appropriate steps in the application to limit modbus access to the device.

  • No fix plannedQUINT4-UPS/24DC/24DC/40/EIPphoenix_contact_psirt

    Configuration via unauthenticated modbus commands is a commonly used feature in the industrial sector. It is necessary take appropriate steps in the application to limit modbus access to the device.

  • No fix plannedQUINT4-UPS/24DC/24DC/5/EIPphoenix_contact_psirt

    Configuration via unauthenticated modbus commands is a commonly used feature in the industrial sector. It is necessary take appropriate steps in the application to limit modbus access to the device.

02

cvss

Technical severity, 0–10. One row per scoring source.

7.5
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · info@cert.vde.comexploitability 3.9 · impact 3.6
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · Phoenix Contact PSIRT DE
v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-306USCWE-306US
05

affected products (20)

Products and version ranges known to be affected.

06

advisories (1)

Vendor and ecosystem advisories describing this.

  • VDE-2025-072Phoenix Contact: Security Advisory for QUINT4-UPS EIP2025-10-14csaf · phoenix_contact_psirtDE

    Multiple vulnerabilities were discovered in the firmware of QUINT4-UPS EIP devices that can be used by an unauthenticated remote attacker to perform Denial of Service attacks and to gather login credentials for the Webfrontend.

07

also known as (3)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdphoenix_contact_psirtNVDCVE.orgMITRE
published 2025-10-14modified 2026-10-18
09

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan