CVE-2025-41770

published 2026-08-12

CVE-2025-41770: An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an remote attacker to interrupt access via…

Priority P3 46 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I N A H

An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an remote attacker to interrupt access via the client application. Successful exploitation prevents communication until the PLCnext service is manually restarted.

Affected

17 ranges

Vendor	Product	Version range	Fixed in
phoenix_contact	axc_f_1152	>= 2019.0.4 < 2026.0.3	2026.0.3
phoenix_contact	axc_f_1252	>= 2019.0.4 < 2026.0.3	2026.0.3
phoenix_contact	axc_f_2000_ea	>= 2019.0.4 < 2026.0.3	2026.0.3
phoenix_contact	axc_f_2152	>= 2019.0.4 < 2026.0.3	2026.0.3
phoenix_contact	axc_f_3152	>= 2019.0.4 < 2026.0.3	2026.0.3
phoenix_contact	bpc_9102s	>= 2019.0.4 < 2026.0.3	2026.0.3
phoenix_contact	bpc_9202s	>= 2019.0.4 < 2026.0.3	2026.0.3
phoenix_contact	catan_c1	>= 2019.0.4 < 2026.0.3	2026.0.3
phoenix_contact	epc_1502	>= 2019.0.4 < 2026.0.3	2026.0.3
phoenix_contact	epc_1522	>= 2019.0.4 < 2026.0.3	2026.0.3
phoenix_contact	rfc_4072r	>= 2019.0.4 < 2026.0.3	2026.0.3
phoenix_contact	rfc_4072s	>= 2019.0.4 < 2026.0.3	2026.0.3
phoenix_contact	vl3_upc_2440_edge	>= 2019.0.4 < 2026.0.3	2026.0.3
phoenix_contact	vplcnext_control_1000	>= 2019.0.4 < 2026.0.3	2026.0.3
phoenix_contact	vplcnext_control_2000	>= 2019.0.4 < 2026.0.3	2026.0.3
phoenix_contact	vplcnext_control_3000	>= 2019.0.4 < 2026.0.3	2026.0.3
phoenix_contact	vplcnext_control_500	>= 2019.0.4 < 2026.0.3	2026.0.3

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

nvd v4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-770