Phoenix Contact
170 CVEs across 247 Phoenix Contact products. Browse Phoenix Contact vulnerabilities, severities, and proof-of-concept exploits.
Phoenix Contact products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-41771 | Medium | 4.3 | 2026-08-12 | An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability a… |
CVE-2025-41770 | High | 7.5 | 2026-08-12 | An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an remote attacker to interrupt access via th… |
CVE-2025-41769 | Critical | 9.8 | 2026-08-12 | The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default configuration. An unauthenticated remote attacker could… |
CVE-2026-7849 | Critical | 9.8 | 2026-07-30 | Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subse… |
CVE-2026-44108 | Critical | 9.8 | 2026-07-30 | Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system shutdown. This creates a temporary window… |
CVE-2026-44107 | High | 7.5 | 2026-07-30 | A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enabled by opening the… |
CVE-2026-44106 | High | 7.8 | 2026-07-30 | A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulti… |
CVE-2026-44105 | Medium | 6.6 | 2026-07-30 | The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the logs to auth… |
CVE-2026-44104 | Critical | 9.8 | 2026-07-30 | The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification. This… |
CVE-2026-44103 | Medium | 5.3 | 2026-07-30 | An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates with… |
CVE-2026-44102 | Medium | 5.3 | 2026-07-30 | An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This will cause the file… |
CVE-2026-44101 | Critical | 9.8 | 2026-07-30 | Due to missing authentication the CHARX OCPP Agent service allows an unauthenticated remote attacker to reconfigure the backend connection. This can lead to De… |
CVE-2026-44100 | Critical | 9.4 | 2026-07-30 | The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to disclosure of charging point UIDs, Denial… |
CVE-2026-44099 | High | 7.8 | 2026-07-30 | A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full sy… |
CVE-2026-44098 | High | 8.6 | 2026-07-30 | This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulti… |
CVE-2026-44097 | High | 7.1 | 2026-07-30 | A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent… |
CVE-2026-44096 | High | 7.8 | 2026-07-30 | A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full system compromise. |
CVE-2026-44095 | High | 7.8 | 2026-07-30 | A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commands as root, resul… |
CVE-2026-44094 | High | 8.6 | 2026-07-30 | An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including default credentials. Th… |
CVE-2026-44093 | High | 7.8 | 2026-07-30 | A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, r… |
CVE-2026-44092 | Critical | 9.1 | 2026-07-30 | An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. Th… |
CVE-2026-44091 | Critical | 9.1 | 2026-07-30 | An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system configuration… |
CVE-2026-44090 | Critical | 9.8 | 2026-07-30 | Due to missing authentication, an unauthenticated remote attacker may access the MQTT broker, which is only protected from external access by a firewall. This… |
CVE-2026-41032 | High | 7.5 | 2026-06-03 | It is possible for an unauthenticated adjacent attacker to download log files of the controller, which may disclose some restricted information. |
CVE-2025-41670 | High | 7.8 | 2026-05-27 | A local user with low privileges may be able to influence the behavior of a privileged system service by manipulating configuration or application-related file… |
CVE-2025-41669 | High | 8.8 | 2026-05-27 | The Web-based Management allows a remote low privileged Engineer user to install additional APPs on the device downloaded from the PLCnext Store without implem… |
CVE-2024-43384 | High | 8.0 | 2026-05-07 | A low privileged remote attacker can gain the root password due to improper removal of sensitive information before storage or transfer. |
CVE-2026-22323 | High | 7.1 | 2026-03-18 | A CSRF vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker to trick authenticated users into sending unauth… |
CVE-2026-22322 | High | 7.1 | 2026-03-18 | A stored cross‑site scripting (XSS) vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker to create a trunk e… |
CVE-2026-22321 | Medium | 5.3 | 2026-03-18 | A stack-based buffer overflow in the device's Telnet/SSH CLI login routine occurs when a unauthenticated attacker send an oversized or unexpected username inpu… |
CVE-2026-22320 | Medium | 6.5 | 2026-03-18 | A stack-based buffer overflow in the CLI's TFTP file‑transfer command handling allows a low-privileged attacker with Telnet/SSH access to trigger memory corrup… |
CVE-2026-22319 | Medium | 4.9 | 2026-03-18 | A stack-based buffer overflow in the device's file installation workflow allows a high-privileged attacker to send oversized POST parameters that overflow a fi… |
CVE-2026-22318 | Medium | 4.9 | 2026-03-18 | A stack-based buffer overflow vulnerability in the device's file transfer parameter workflow allows a high-privileged attacker to send oversized POST parameter… |
CVE-2026-22317 | High | 7.2 | 2026-03-18 | A command injection vulnerability in the device’s Root CA certificate transfer workflow allows a high-privileged attacker to send crafted HTTP POST requests th… |
CVE-2026-22316 | Medium | 6.5 | 2026-03-18 | A remote attacker with user privileges for the webUI can use the setting of the TFTP Filename with a POST Request to trigger a stack-based Buffer Overflow, res… |
CVE-2025-41717 | High | 8.8 | 2026-01-13 | An unauthenticated remote attacker can trick a high privileged user into uploading a malicious payload via the config-upload endpoint, leading to code injectio… |
CVE-2025-41752 | High | 7.1 | 2025-12-09 | An XSS vulnerability in pxc_portSfp.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the a… |
CVE-2025-41751 | High | 7.1 | 2025-12-09 | An XSS vulnerability in pxc_portCntr.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the… |
CVE-2025-41750 | High | 7.1 | 2025-12-09 | An XSS vulnerability in pxc_PortCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the a… |
CVE-2025-41749 | High | 7.1 | 2025-12-09 | An XSS vulnerability in port_util.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the att… |
CVE-2025-41748 | High | 7.1 | 2025-12-09 | An XSS vulnerability in pxc_Dot1xCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the… |
CVE-2025-41747 | High | 7.1 | 2025-12-09 | An XSS vulnerability in pxc_vlanIntfCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request… |
CVE-2025-41746 | High | 7.1 | 2025-12-09 | An XSS vulnerability in pxc_portSecCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request… |
CVE-2025-41745 | High | 7.1 | 2025-12-09 | An XSS vulnerability in pxc_portCntr2.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request t… |
CVE-2025-41697 | Medium | 6.8 | 2025-12-09 | An attacker can use an undocumented UART port on the PCB as a side-channel to get root access e.g. with the credentials obtained from CVE-2025-41692. |
CVE-2025-41696 | Medium | 4.6 | 2025-12-09 | An attacker can use an undocumented UART port on the PCB as a side-channel with the user hardcoded credentials obtained from CVE-2025-41692 to gain read access… |
CVE-2025-41695 | High | 7.1 | 2025-12-09 | An XSS vulnerability in dyn_conn.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the… |
CVE-2025-41694 | Medium | 6.5 | 2025-12-09 | A low privileged remote attacker can run the webshell with an empty command containing whitespace. The server will then block until it receives more data, resu… |
CVE-2025-41693 | Medium | 4.3 | 2025-12-09 | A low privileged remote attacker can use the ssh feature to execute commands directly after login. The process stays open and uses resources which leads to a r… |
CVE-2025-41692 | Medium | 6.8 | 2025-12-09 | A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak passwo… |
CVE-2025-41699 | High | 8.8 | 2025-10-14 | An low privileged remote attacker with an account for the Web-based management can change the system configuration to perform a command injection as root, resu… |
CVE-2025-41707 | Medium | 5.3 | 2025-10-14 | The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the is… |
CVE-2025-41706 | Medium | 5.3 | 2025-10-14 | The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-leng… |
CVE-2025-41705 | Medium | 6.8 | 2025-10-14 | An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend. |
CVE-2025-41704 | Medium | 5.3 | 2025-10-14 | An unauthanticated remote attacker can perform a DoS of the Modbus service by sending a specific function and sub-function code without affecting the core func… |
CVE-2025-41703 | High | 7.5 | 2025-10-14 | An unauthenticated remote attacker can cause a Denial of Service by turning off the output of the UPS via Modbus command. |
CVE-2025-41686 | High | 7.8 | 2025-08-12 | A low-privileged local attacker can exploit improper permissions on nssm.exe to escalate their privileges and gain administrative access. |
CVE-2025-2813 | High | 7.5 | 2025-07-31 | An unauthenticated remote attacker can cause a Denial of Service by sending a large number of requests to the http service on port 80. |
CVE-2025-41668 | High | 8.8 | 2025-07-08 | A low privileged remote attacker with file access can replace a critical file or folder used by the service security-profile to get read, write and execute acc… |
CVE-2025-41667 | High | 8.8 | 2025-07-08 | A low privileged remote attacker with file access can replace a critical file used by the arp-preinit script to get read, write and execute access to any file… |
CVE-2025-41666 | High | 8.8 | 2025-07-08 | A low privileged remote attacker with file access can replace a critical file used by the watchdog to get read, write and execute access to any file on the dev… |
CVE-2025-41665 | Medium | 6.5 | 2025-07-08 | An low privileged remote attacker can enforce the watchdog of the affected devices to reboot the PLC due to incorrect default permissions of a config file. |
CVE-2025-25271 | High | 8.8 | 2025-07-08 | An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface. |
CVE-2025-25270 | Critical | 9.8 | 2025-07-08 | An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations. |
CVE-2025-25269 | High | 8.4 | 2025-07-08 | An unauthenticated local attacker can inject a command that is subsequently executed as root, leading to a privilege escalation. |
CVE-2025-25268 | High | 8.8 | 2025-07-08 | An unauthenticated adjacent attacker can modify configuration by sending specific requests to an API-endpoint resulting in read and write access due to missing… |
CVE-2025-24006 | High | 7.8 | 2025-07-08 | A low privileged local attacker can leverage insecure permissions via SSH on the affected devices to escalate privileges to root. |
CVE-2025-24005 | High | 7.8 | 2025-07-08 | A local attacker with a local user account can leverage a vulnerable script via SSH to escalate privileges to root due to improper input validation. |
CVE-2025-24004 | Medium | 5.2 | 2025-07-08 | A physical attacker with access to the device display via USB-C can send a message to the device which triggers an unsecure copy to a buffer resulting in loss… |
CVE-2025-24003 | High | 8.2 | 2025-07-08 | An unauthenticated remote attacker can use MQTT messages to trigger out-of-bounds writes in charging stations complying with German Calibration Law, resulting… |
CVE-2025-24002 | Medium | 5.3 | 2025-07-08 | An unauthenticated remote attacker can use MQTT messages to crash a service on charging stations complying with German Calibration Law, resulting in a temporar… |
CVE-2018-25112 | High | 7.5 | 2025-06-04 | An unauthenticated remote attacker may use an uncontrolled resource consumption in the IEC 61131 program of the affected products by creating large amounts of… |
CVE-2024-11497 | High | 8.8 | 2025-01-14 | An authenticated attacker can use this vulnerability to perform a privilege escalation to gain root access. |
CVE-2024-7699 | High | 8.8 | 2024-09-10 | An low privileged remote attacker can execute OS commands with root privileges due to improper neutralization of special elements in user data. |
CVE-2024-7698 | Medium | 5.7 | 2024-09-10 | A low privileged remote attacker can get access to CSRF tokens of higher privileged users which can be abused to mount CSRF attacks. |
CVE-2024-43393 | High | 8.1 | 2024-09-10 | A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control… |
CVE-2024-43392 | High | 8.1 | 2024-09-10 | A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control… |
CVE-2024-43391 | High | 8.1 | 2024-09-10 | A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control… |
CVE-2024-43390 | High | 8.1 | 2024-09-10 | A low privileged remote attacker can perform configuration changes of the firewall services, including packet forwarding or NAT through the FW_NAT.IN_IP enviro… |
CVE-2024-43389 | High | 8.1 | 2024-09-10 | A low privileged remote attacker can perform configuration changes of the ospf service through OSPF_INTERFACE.SIMPLE_KEY, OSPF_INTERFACE.DIGEST_KEY environment… |
CVE-2024-43388 | High | 8.8 | 2024-09-10 | A low privileged remote attacker with write permissions can reconfigure the SNMP service due to improper input validation. |
CVE-2024-43387 | High | 8.8 | 2024-09-10 | A low privileged remote attacker can read and write files as root due to improper neutralization of special elements in the variable EMAIL_RELAY_PASSWORD in mG… |
CVE-2024-43386 | High | 8.8 | 2024-09-10 | A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable… |
CVE-2024-43385 | High | 8.8 | 2024-09-10 | A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable… |
CVE-2024-7734 | Medium | 5.3 | 2024-09-10 | An unauthenticated remote attacker can exploit the behavior of the pathfinder TCP encapsulation service by establishing a high number of TCP connections to the… |
CVE-2024-6788 | High | 8.6 | 2024-08-13 | A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileg… |
CVE-2024-3913 | Medium | 5.9 | 2024-08-13 | An unauthenticated remote attacker can use this vulnerability to change the device configuration due to a file writeable for short time after system startup. |
CVE-2024-28137 | High | 7.8 | 2024-05-14 | A local attacker with low privileges can perform a privilege escalation with an init script due… |
CVE-2024-28136 | High | 7.8 | 2024-05-14 | A local attacker with low privileges can use a command injection vulnerability to gain root privileges due to improper input validation using the OCPP Remote s… |
CVE-2024-28135 | Medium | 5.0 | 2024-05-14 | A low privileged remote attacker can use a command injection vulnerability in the API which performs remote code execution as the user-app user due to improper… |
CVE-2024-28134 | High | 7.0 | 2024-05-14 | An unauthenticated remote attacker can extract a session token with a MitM attack and gain web-b… |
CVE-2024-28133 | High | 7.8 | 2024-05-14 | A local low privileged attacker can use an untrusted search path in a CHARX system utility to gain root privileges. … |
CVE-2024-26288 | High | 8.7 | 2024-03-12 | An unauthenticated remote attacker can influence the communication due to the lack of encryption of sensitive data via a MITM. Charging is not affected. |
CVE-2024-26005 | Medium | 4.8 | 2024-03-12 | An unauthenticated remote attacker can gain service level privileges through an incomplete cleanup during service restart after a DoS. |
CVE-2024-26004 | High | 7.5 | 2024-03-12 | An unauthenticated remote attacker can DoS a control agent due to access of a uninitialized pointer which may prevent or disrupt the charging functionality. |
CVE-2024-26003 | High | 7.5 | 2024-03-12 | An unauthenticated remote attacker can DoS the control agent due to a out-of-bounds read which may prevent or disrupt the charging functionality. |
CVE-2024-26002 | High | 7.8 | 2024-03-12 | An improper input validation in the Qualcom plctool allows a local attacker with low privileges to gain root access by changing the ownership of specific files. |
CVE-2024-26001 | High | 7.4 | 2024-03-12 | An unauthenticated remote attacker can write memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always succ… |
CVE-2024-26000 | Medium | 5.9 | 2024-03-12 | An unauthenticated remote attacker can read memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always succe… |
CVE-2024-25999 | High | 8.4 | 2024-03-12 | An unauthenticated local attacker can perform a privilege escalation due to improper input validation in the OCPP agent service. |