CVE-2025-41717

highpriority · track · 0EPSS 0.006 · 46 %ileDEEU
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.55% (46th) EPSS
CVSS 8.8 · high
Is it mine?
55 products
Check your exposure
Who says so?
4 sources
cnnvd · enisa_euvd · cert_bund · phoenix_contact_psirt

EPSS · scored 2026-10-27

An unauthenticated remote attacker can trick a high privileged user into uploading a malicious payload via the config-upload endpoint, leading to code injection as root. This results in a total loss of confidentiality, availability and integrity due to improper control of code generation ('Code Injection’).

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedFirmware <FW 1.06.23 installed on TC ROUTER 5004T-5G EUphoenix_contact_psirt

    Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |

  • FixedFirmware <FW 3.07.7 installed on CLOUD CLIENT 1101T-TX/TXphoenix_contact_psirt

    Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |

  • FixedFirmware <FW 3.07.7 installed on TC CLOUD CLIENT 1002-TX/TXphoenix_contact_psirt

    Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |

  • FixedFirmware <FW 3.08.8 installed on TC CLOUD CLIENT 1002-4G ATTphoenix_contact_psirt

    Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |

  • FixedFirmware <FW 3.08.8 installed on TC ROUTER 2002T-3Gphoenix_contact_psirt

    Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |

  • FixedFirmware <FW 3.08.8 installed on TC ROUTER 2002T-4Gphoenix_contact_psirt

    Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |

  • FixedFirmware <FW 3.08.8 installed on TC ROUTER 3002T-3Gphoenix_contact_psirt

    Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |

  • FixedFirmware <FW 3.08.8 installed on TC ROUTER 3002T-4Gphoenix_contact_psirt

    Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |

  • FixedFirmware <FW 3.08.8 installed on TC ROUTER 3002T-4G ATTphoenix_contact_psirt

    Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |

  • FixedFirmware <FW 3.08.8 installed on TC ROUTER 3002T-4G GLphoenix_contact_psirt

    Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |

  • FixedFirmware <FW 3.08.8 installed on TC ROUTER 3002T-4G VZWphoenix_contact_psirt

    Phoenix Contact recommends to upgrade to the latest firmware which will fix this vulnerability. | Product | Fixed Version | |----------------------------------|---------------| | TC ROUTER 3002T-3G | 3.08.8 | | TC ROUTER 2002T-3G | 3.08.8 | | TC ROUTER 3002T-4G | 3.08.8 | | TC ROUTER 3002T-4G GL | 3.08.8 | | TC ROUTER 5004T-5G EU | 1.06.23 | | TC ROUTER 3002T-4G VZW | 3.08.8 | | TC ROUTER 3002T-4G ATT | 3.08.8 | | TC ROUTER 2002T-4G | 3.08.8 | | CLOUD CLIENT 1101T-TX/TX | 3.07.7 | | TC CLOUD CLIENT 1002-4G ATT | 3.08.8 | | TC CLOUD CLIENT 1002-TX/TX | 3.07.7 |

  • MitigationFirmware <FW 1.06.23 installed on TC ROUTER 5004T-5G EUphoenix_contact_psirt

    As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.

  • MitigationFirmware <FW 3.07.7 installed on CLOUD CLIENT 1101T-TX/TXphoenix_contact_psirt

    As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.

  • MitigationFirmware <FW 3.07.7 installed on TC CLOUD CLIENT 1002-TX/TXphoenix_contact_psirt

    As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.

  • MitigationFirmware <FW 3.08.8 installed on TC CLOUD CLIENT 1002-4G ATTphoenix_contact_psirt

    As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.

  • MitigationFirmware <FW 3.08.8 installed on TC ROUTER 2002T-3Gphoenix_contact_psirt

    As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.

  • MitigationFirmware <FW 3.08.8 installed on TC ROUTER 2002T-4Gphoenix_contact_psirt

    As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.

  • MitigationFirmware <FW 3.08.8 installed on TC ROUTER 3002T-3Gphoenix_contact_psirt

    As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.

  • MitigationFirmware <FW 3.08.8 installed on TC ROUTER 3002T-4Gphoenix_contact_psirt

    As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.

  • MitigationFirmware <FW 3.08.8 installed on TC ROUTER 3002T-4G ATTphoenix_contact_psirt

    As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.

  • MitigationFirmware <FW 3.08.8 installed on TC ROUTER 3002T-4G GLphoenix_contact_psirt

    As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.

  • MitigationFirmware <FW 3.08.8 installed on TC ROUTER 3002T-4G VZWphoenix_contact_psirt

    As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.

02

cvss

Technical severity, 0–10. One row per scoring source.

8.8
010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · ENISA EU
v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · info@cert.vde.comexploitability 2.8 · impact 5.9
v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · Phoenix Contact PSIRT DE
v3.18.1highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-94USCWE-94US
05

affected products (55)

Products and version ranges known to be affected.

showing 20 of 55
06

advisories (2)

Vendor and ecosystem advisories describing this.

  • VDE-2025-073Phoenix Contact: Security Advisory for TC ROUTER and CLOUD CLIENT Industrial mobile network routers2026-01-13csaf · phoenix_contact_psirtDE

    A code injection vulnerability at the upload-config endpoint in the firmware of TC ROUTER and CLOUD CLIENT Industrial Mobile network routers has been discovered that can be exploited by an high privileged attacker.

  • WID-SEC-W-2026-0067Phoenix Contact TC ROUTER und TC CLOUD CLIENT: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit AdministratorrechtenDeutsch2026-01-12csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Phoenix Contact TC ROUTER und TC CLOUD CLIENT Geräten ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen.

07

also known as (3)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdcert_bundphoenix_contact_psirtNVDCVE.orgMITRE
published 2026-01-13modified 2026-06-17
09

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan