Do Son 
TL;DR
Phoenix Contact disclosed three vulnerabilities in PLCnext firmware on August 12, 2026. One flaw, CVE-2025-41771, lets a low-privileged attacker execute unauthorized SQL queries. A second, critical bug scores a CVSS 9.8 and allows remote code execution.
- Product: Phoenix Contact AXC F 1152
- Vulnerabilities: 3 flaws (CVE-2025-41769, CVE-2025-41770, CVE-2025-41771)
- Highest severity: 9.8 (Critical · CVSSv3)
- Worst impact: Unauthenticated Buffer Overflow in PROFINET Service
- Status: No confirmed exploitation yet; patches available
- Action: Update to 2026.0.3 now
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2025-41769 | 9.8 | Unauthenticated Buffer Overflow in PROFINET Service | 2026.0.3 | Not exploited |
| CVE-2025-41770 | 7.5 | Unauthenticated Denial of Service | 2026.0.3 | Not exploited |
| CVE-2025-41771 | 4.3 | SQL injection | 2026.0.3 | Not exploited |
Why it matters
PLCnext controllers run factory and infrastructure automation. So flaws here can disrupt physical processes. The most severe bug needs no login at all.
That flaw, CVE-2025-41769, is a buffer overflow in the PROFINET service. It rates a critical CVSS 9.8. An unauthenticated attacker could reboot the device or run code.
How the attacks work
The three flaws hit different parts of the system. The critical bug abuses a buffer overflow in the default PROFINET configuration. A second bug, CVE-2025-41770, exhausts resources to cause a denial of service.
The third bug is the SQL injection issue. According to the advisory, a low-privileged user reaches a vulnerable web interface endpoint. From there, they can execute unauthorized SQL queries against a local database.
Limited SQL injection scope
The SQL injection risk is real but contained. It affects only a SQLite database used for notification messages. Therefore, its rated impact stays medium at CVSS 4.3.
Affected versions
All PLCnext firmware versions before 2026.0.3 are affected. The advisory lists many PLCnext Control devices, including AXC F and RFC series controllers. Virtual PLCnext products are also in scope. Read the full CERT@VDE advisory VDE-2025-056 for the device list.
Exploitation status
No public proof-of-concept has been reported. Likewise, no in-the-wild exploitation is confirmed.
Patch and mitigation steps
Update affected devices to PLCnext firmware 2026.0.3 or later. That release fixes all three flaws. If you cannot patch, run the devices behind a firewall.
Phoenix Contact also advises operating controllers in closed networks. Restricting network access blunts the unauthorized SQL queries and the more serious remote code execution risk.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
