CVE-2025-41669

published 2026-05-27

CVE-2025-41669: The Web-based Management allows a remote low privileged Engineer user to install additional APPs on the device downloaded from the PLCnext Store without…

high 8.7 CVSS 4.0

AV N AC L AT N PR L UI N VC H VI H VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

The Web-based Management allows a remote low privileged Engineer user to install additional APPs on the device downloaded from the PLCnext Store without implementing any data verification mechanism, leading to the capability for an Engineer user to reach arbitrary code execution with root privileges on the PLC device. A successful exploitation may allow to install a manipulated APP package, potentially impacting integrity and availability of the PLCnext Control.

Affected

14 ranges

Vendor	Product	Version range	Fixed in
phoenix_contact	axc_f_1152	>= 0.0.0 < 2026.0.3	2026.0.3
phoenix_contact	axc_f_1252	>= 0.0.0 < 2026.0.3	2026.0.3
phoenix_contact	axc_f_2000_ea	>= 0.0.0 < 2026.0.3	2026.0.3
phoenix_contact	axc_f_2152	>= 0.0.0 < 2026.0.3	2026.0.3
phoenix_contact	axc_f_3152	>= 0.0.0 < 2026.0.3	2026.0.3
phoenix_contact	bpc_9102s	>= 0.0.0 < 2026.0.3	2026.0.3
phoenix_contact	epc_1522	>= 0.0.0 < 2026.0.3	2026.0.3
phoenix_contact	rfc_4072r	>= 0.0.0 < 2026.0.3	2026.0.3
phoenix_contact	rfc_4072s	>= 0.0.0 < 2026.0.3	2026.0.3
phoenix_contact	vl3_upc_2440_edge	>= 0.0.0 < 2026.0.3	2026.0.3
phoenix_contact	vplcnext_control_1000	>= 0.0.0 < 2026.0.3	2026.0.3
phoenix_contact	vplcnext_control_2000	>= 0.0.0 < 2026.0.3	2026.0.3
phoenix_contact	vplcnext_control_3000	>= 0.0.0 < 2026.0.3	2026.0.3
phoenix_contact	vplcnext_control_500	>= 0.0.0 < 2026.0.3	2026.0.3

CWE-347