Phoenixcontact
27 CVEs across 680 Phoenixcontact products. Browse Phoenixcontact vulnerabilities, severities, and proof-of-concept exploits.
Phoenixcontact products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-43384 | High | 8.0 | 2026-05-07 | A low privileged remote attacker can gain the root password due to improper removal of sensitive information before storage or transfer. |
CVE-2025-41752 | High | 7.1 | 2025-12-09 | An XSS vulnerability in pxc_portSfp.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the a… |
CVE-2025-41751 | High | 7.1 | 2025-12-09 | An XSS vulnerability in pxc_portCntr.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the… |
CVE-2025-41750 | High | 7.1 | 2025-12-09 | An XSS vulnerability in pxc_PortCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the a… |
CVE-2025-41749 | High | 7.1 | 2025-12-09 | An XSS vulnerability in port_util.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the att… |
CVE-2025-41748 | High | 7.1 | 2025-12-09 | An XSS vulnerability in pxc_Dot1xCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the… |
CVE-2025-41747 | High | 7.1 | 2025-12-09 | An XSS vulnerability in pxc_vlanIntfCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request… |
CVE-2025-41746 | High | 7.1 | 2025-12-09 | An XSS vulnerability in pxc_portSecCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request… |
CVE-2025-41745 | High | 7.1 | 2025-12-09 | An XSS vulnerability in pxc_portCntr2.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request t… |
CVE-2025-41697 | Medium | 6.8 | 2025-12-09 | An attacker can use an undocumented UART port on the PCB as a side-channel to get root access e.g. with the credentials obtained from CVE-2025-41692. |
CVE-2025-41696 | Medium | 4.6 | 2025-12-09 | An attacker can use an undocumented UART port on the PCB as a side-channel with the user hardcoded credentials obtained from CVE-2025-41692 to gain read access… |
CVE-2025-41695 | High | 7.1 | 2025-12-09 | An XSS vulnerability in dyn_conn.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the… |
CVE-2025-41694 | Medium | 6.5 | 2025-12-09 | A low privileged remote attacker can run the webshell with an empty command containing whitespace. The server will then block until it receives more data, resu… |
CVE-2025-41693 | Medium | 4.3 | 2025-12-09 | A low privileged remote attacker can use the ssh feature to execute commands directly after login. The process stays open and uses resources which leads to a r… |
CVE-2025-41692 | Medium | 6.8 | 2025-12-09 | A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak passwo… |
CVE-2025-25271 | High | 8.8 | 2025-07-08 | An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface. |
CVE-2025-25270 | Critical | 9.8 | 2025-07-08 | An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations. |
CVE-2025-25269 | High | 8.4 | 2025-07-08 | An unauthenticated local attacker can inject a command that is subsequently executed as root, leading to a privilege escalation. |
CVE-2025-25268 | High | 8.8 | 2025-07-08 | An unauthenticated adjacent attacker can modify configuration by sending specific requests to an API-endpoint resulting in read and write access due to missing… |
CVE-2025-24006 | High | 7.8 | 2025-07-08 | A low privileged local attacker can leverage insecure permissions via SSH on the affected devices to escalate privileges to root. |
CVE-2025-24005 | High | 7.8 | 2025-07-08 | A local attacker with a local user account can leverage a vulnerable script via SSH to escalate privileges to root due to improper input validation. |
CVE-2025-24004 | Medium | 5.2 | 2025-07-08 | A physical attacker with access to the device display via USB-C can send a message to the device which triggers an unsecure copy to a buffer resulting in loss… |
CVE-2025-24003 | High | 8.2 | 2025-07-08 | An unauthenticated remote attacker can use MQTT messages to trigger out-of-bounds writes in charging stations complying with German Calibration Law, resulting… |
CVE-2025-24002 | Medium | 5.3 | 2025-07-08 | An unauthenticated remote attacker can use MQTT messages to crash a service on charging stations complying with German Calibration Law, resulting in a temporar… |
CVE-2024-7699 | High | 8.8 | 2024-09-10 | An low privileged remote attacker can execute OS commands with root privileges due to improper neutralization of special elements in user data. |
CVE-2024-7698 | Medium | 5.7 | 2024-09-10 | A low privileged remote attacker can get access to CSRF tokens of higher privileged users which can be abused to mount CSRF attacks. |
CVE-2024-43393 | High | 8.1 | 2024-09-10 | A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control… |
CVE-2024-43392 | High | 8.1 | 2024-09-10 | A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control… |
CVE-2024-43391 | High | 8.1 | 2024-09-10 | A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control… |
CVE-2024-43390 | High | 8.1 | 2024-09-10 | A low privileged remote attacker can perform configuration changes of the firewall services, including packet forwarding or NAT through the FW_NAT.IN_IP enviro… |
CVE-2024-43389 | High | 8.1 | 2024-09-10 | A low privileged remote attacker can perform configuration changes of the ospf service through OSPF_INTERFACE.SIMPLE_KEY, OSPF_INTERFACE.DIGEST_KEY environment… |
CVE-2024-43388 | High | 8.8 | 2024-09-10 | A low privileged remote attacker with write permissions can reconfigure the SNMP service due to improper input validation. |
CVE-2024-43387 | High | 8.8 | 2024-09-10 | A low privileged remote attacker can read and write files as root due to improper neutralization of special elements in the variable EMAIL_RELAY_PASSWORD in mG… |
CVE-2024-43386 | High | 8.8 | 2024-09-10 | A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable… |
CVE-2024-43385 | High | 8.8 | 2024-09-10 | A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable… |
CVE-2024-7734 | Medium | 5.3 | 2024-09-10 | An unauthenticated remote attacker can exploit the behavior of the pathfinder TCP encapsulation service by establishing a high number of TCP connections to the… |
CVE-2024-6788 | High | 8.6 | 2024-08-13 | A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileg… |
CVE-2024-3913 | Medium | 5.9 | 2024-08-13 | An unauthenticated remote attacker can use this vulnerability to change the device configuration due to a file writeable for short time after system startup. |
CVE-2024-28137 | High | 7.8 | 2024-05-14 | A local attacker with low privileges can perform a privilege escalation with an init script due… |
CVE-2024-28136 | High | 7.8 | 2024-05-14 | A local attacker with low privileges can use a command injection vulnerability to gain root privileges due to improper input validation using the OCPP Remote s… |
CVE-2024-28135 | Medium | 5.0 | 2024-05-14 | A low privileged remote attacker can use a command injection vulnerability in the API which performs remote code execution as the user-app user due to improper… |
CVE-2024-28134 | High | 7.0 | 2024-05-14 | An unauthenticated remote attacker can extract a session token with a MitM attack and gain web-b… |
CVE-2024-28133 | High | 7.8 | 2024-05-14 | A local low privileged attacker can use an untrusted search path in a CHARX system utility to gain root privileges. … |
CVE-2024-26288 | High | 8.7 | 2024-03-12 | An unauthenticated remote attacker can influence the communication due to the lack of encryption of sensitive data via a MITM. Charging is not affected. |
CVE-2024-26005 | Medium | 4.8 | 2024-03-12 | An unauthenticated remote attacker can gain service level privileges through an incomplete cleanup during service restart after a DoS. |
CVE-2024-26004 | High | 7.5 | 2024-03-12 | An unauthenticated remote attacker can DoS a control agent due to access of a uninitialized pointer which may prevent or disrupt the charging functionality. |
CVE-2024-26003 | High | 7.5 | 2024-03-12 | An unauthenticated remote attacker can DoS the control agent due to a out-of-bounds read which may prevent or disrupt the charging functionality. |
CVE-2024-26002 | High | 7.8 | 2024-03-12 | An improper input validation in the Qualcom plctool allows a local attacker with low privileges to gain root access by changing the ownership of specific files. |
CVE-2024-26001 | High | 7.4 | 2024-03-12 | An unauthenticated remote attacker can write memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always succ… |
CVE-2024-26000 | Medium | 5.9 | 2024-03-12 | An unauthenticated remote attacker can read memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always succe… |
CVE-2024-25999 | High | 8.4 | 2024-03-12 | An unauthenticated local attacker can perform a privilege escalation due to improper input validation in the OCPP agent service. |
CVE-2024-25998 | High | 7.3 | 2024-03-12 | An unauthenticated remote attacker can perform a command injection in the OCPP Service with limited privileges due to improper input validation. |
CVE-2024-25997 | Medium | 5.3 | 2024-03-12 | An unauthenticated remote attacker can perform a log injection due to improper input validation. Only a certain log file is affected. |
CVE-2024-25996 | Medium | 5.3 | 2024-03-12 | An unauthenticated remote attacker can perform a remote code execution due to an origin validation error. The access is limited to the service user. |
CVE-2024-25995 | Critical | 9.8 | 2024-03-12 | An unauthenticated remote attacker can modify configurations to perform a remote code execution, gain root rights or perform an DoS due to improper input valid… |
CVE-2024-25994 | Medium | 5.3 | 2024-03-12 | An unauthenticated remote attacker can upload a arbitrary script file due to improper input validation. The upload destination is fixed and is write only. |
CVE-2023-5592 | High | 7.5 | 2023-12-14 | Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attac… |
CVE-2023-46144 | Medium | 6.5 | 2023-12-14 | A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with low privileges to compromise integrity on the affec… |
CVE-2023-46143 | High | 7.5 | 2023-12-14 | Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all app… |
CVE-2023-46142 | High | 8.8 | 2023-12-14 | A incorrect permission assignment for critical resource vulnerability in PLCnext products allows an remote attacker with low privileges to gain full access on… |
CVE-2023-46141 | Critical | 9.8 | 2023-12-14 | Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated at… |
CVE-2023-0757 | Critical | 9.8 | 2023-12-14 | Incorrect Permission Assignment for Critical Resource vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated… |
CVE-2023-3935 | Critical | 9.8 | 2023-09-13 | A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE an… |
CVE-2023-37864 | High | 7.2 | 2023-08-09 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with SNMPv2 write privileges may use an a special SNMP request to g… |
CVE-2023-37863 | High | 7.2 | 2023-08-09 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with SNMPv2 write privileges may use an a special SNMP request to g… |
CVE-2023-37862 | High | 8.2 | 2023-08-09 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an unauthenticated remote attacker can access upload-functions of the HTTP API. This… |
CVE-2023-37861 | High | 8.8 | 2023-08-09 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated remote attacker can execute code with root permissions with a specia… |
CVE-2023-37860 | High | 7.5 | 2023-08-09 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote unauthenticated attacker can obtain the r/w community string of the SNMPv2 d… |
CVE-2023-37859 | High | 7.2 | 2023-08-09 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 the SNMP daemon is running with root privileges allowing a remote attacker with knowl… |
CVE-2023-37858 | Medium | 4.9 | 2023-08-09 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cry… |
CVE-2023-37857 | Low | 3.8 | 2023-08-09 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cry… |
CVE-2023-37856 | Medium | 4.3 | 2023-08-09 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges is able to gain limited read-access to the devi… |
CVE-2023-37855 | Medium | 4.3 | 2023-08-09 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges is able to gain limited read-access to the devi… |
CVE-2023-3573 | High | 8.8 | 2023-08-08 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a command injection in a HTTP POST requ… |
CVE-2023-3572 | Critical | 10.0 | 2023-08-08 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote, unauthenticated attacker may use an attribute of a specific HTTP POST reque… |
CVE-2023-3571 | High | 8.8 | 2023-08-08 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a specific HTTP POST releated to certif… |
CVE-2023-3570 | High | 8.8 | 2023-08-08 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a specific HTTP DELETE request to gain… |
CVE-2023-3569 | Medium | 4.9 | 2023-08-08 | In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an authenticated remote att… |
CVE-2023-3526 | Critical | 9.6 | 2023-08-08 | In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an unauthenticated remote at… |
CVE-2023-2673 | Medium | 5.3 | 2023-06-13 | Improper Input Validation vulnerability in PHOENIX CONTACT FL/TC MGUARD Family in multiple versions may allow UDP packets to bypass the filter rules and access… |
CVE-2023-1109 | High | 8.8 | 2023-04-17 | In Phoenix Contacts ENERGY AXC PU Web service an authenticated restricted user of the web frontend can access, read, write and create files throughout the file… |
CVE-2022-3737 | High | 7.8 | 2022-11-15 | In PHOENIX CONTACT Automationworx Software Suite up to version 1.89 memory can be read beyond the intended scope due to insufficient validation of input data… |
CVE-2022-3480 | High | 7.5 | 2022-11-15 | A remote, unauthenticated attacker could cause a denial-of-service of PHOENIX CONTACT FL MGUARD and TC MGUARD devices below version 8.9.0 by sending a larger n… |
CVE-2022-3461 | High | 7.8 | 2022-11-15 | In PHOENIX CONTACT Automationworx Software Suite up to version 1.89 manipulated PC Worx or Config+ files could lead to a heap buffer overflow and a read access… |
CVE-2021-34579 | High | 7.5 | 2022-11-09 | In Phoenix Contact: FL MGUARD DM version 1.12.0 and 1.13.0 access to the Apache web server being installed as part of the FL MGUARD DM on Microsoft Windows doe… |
CVE-2022-31801 | Critical | 9.8 | 2022-06-21 | An unauthenticated, remote attacker could upload malicious logic to the devices based on ProConOS/ProConOS eCLR in order to gain full control over the device. |
CVE-2022-31800 | Critical | 9.8 | 2022-06-21 | An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the device. |
CVE-2022-29898 | Critical | 9.1 | 2022-05-11 | On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the configuration file uploader in the WebUI to execute arbitrary code with root… |
CVE-2022-29897 | Critical | 9.1 | 2022-05-11 | On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the traceroute utility integrated in the WebUI to execute arbitrary code with ro… |
CVE-2022-22509 | High | 8.8 | 2022-02-02 | In Phoenix Contact FL SWITCH Series 2xxx in version 3.00 an incorrect privilege assignment allows an low privileged user to enable full access to the device co… |
CVE-2021-34598 | High | 7.5 | 2021-11-10 | In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 the remote logging functionality is impaired by the lack of memory release for da… |
CVE-2021-34582 | Medium | 4.8 | 2021-11-10 | In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 a user with high privileges can inject HTML code (XSS) through web-based manageme… |
CVE-2021-34597 | High | 7.8 | 2021-11-04 | Improper Input Validation vulnerability in PC Worx Automation Suite of Phoenix Contact up to version 1.88 could allow an attacker with a manipulated project fi… |
CVE-2021-34570 | High | 7.5 | 2021-09-27 | Multiple Phoenix Contact PLCnext control devices in versions prior to 2021.0.5 LTS are prone to a DoS attack through special crafted JSON requests. |
CVE-2021-33542 | High | 7.8 | 2021-06-25 | Phoenix Contact Classic Automation Worx Software Suite in Version 1.87 and below is affected by a remote code execution vulnerability. Manipulated PC Worx or C… |
CVE-2021-33541 | High | 7.5 | 2021-06-25 | Phoenix Contact Classic Line Controllers ILC1x0 and ILC1x1 in all versions/variants are affected by a Denial-of-Service vulnerability. The communication protoc… |
CVE-2021-33540 | High | 7.3 | 2021-06-25 | In certain devices of the Phoenix Contact AXL F BK and IL BK product families an undocumented password protected FTP access to the root directory exists. |
CVE-2021-21005 | High | 7.5 | 2021-06-25 | In Phoenix Contact FL SWITCH SMCS series products in multiple versions if an attacker sends a hand-crafted TCP-Packet with the Urgent-Flag set and the Urgent-P… |
CVE-2021-21004 | High | 7.4 | 2021-06-25 | In Phoenix Contact FL SWITCH SMCS series products in multiple versions an attacker may insert malicious code via LLDP frames into the web-based management whic… |
CVE-2021-21003 | Medium | 5.3 | 2021-06-25 | In Phoenix Contact FL SWITCH SMCS series products in multiple versions fragmented TCP-Packets may cause a Denial of Service of Web-, SNMP- and ICMP-Echo servic… |