Latest Phoenix Contact device vulnerabilities #
Four vulnerabilities have been disclosed in certain models and versions of Phoenix Contact Programmable Logic Controller (PLC) PLCnext firmware.
- A low-privileged remote adversary is able to trigger the watchdog service to reboot the device due to incorrect default permissions of a config file. The vulnerability may be used to perform denial-of-service (DoS) attacks against the device or to gain unauthorized access by triggering the vulnerabilities identified below. This vulnerability has been designated CVE-2025-41665 and has been rated medium with a CVSS score of 6.5.
- A low-privileged remote adversary with file access is able to replace a critical file used by the watchdog service. Once the watchdog service has been initialized the adversary gains read, write and execute permissions to the whole file system on the device. This vulnerability has been designated CVE-2025-41666 and has been rated high with a CVSS score of 8.8.
- A low-privileged remote adversary with file access is able to replace a critical file used by the arp-preinit script. Through replacing the critical file the adversary gains read, write and execute permissions to the whole file system on the device. This vulnerability has been designated CVE-2025-41667 and has been rated high with a CVSS score of 8.8.
- A low-privileged remote adversary with file access is able to replace a critical file or directory used by the security-profile service. Through replacing the critical file or directory the adversary gains read, write and execute permissions to the whole file system on the device. This vulnerability has been designated CVE-2025-41668 and has been rated high with a CVSS score of 8.8.
- In addition, multiple vulnerabilities exist in Linux components within the device firmware. Please refer to VDE-2025-053 for the extensive list.
The following models and versions are affected:
- AXC F 1152 firmware versions before 2025.0.2
- AXC F 2152 firmware versions before 2025.0.2
- AXC F 3152 firmware versions before 2025.0.2
- BPC 9102S firmware versions before 2025.0.2
- RFC 4072S firmware versions before 2025.0.2
What is the impact? #
Successful exploitation of CVE-2025-41665 would allow an adversary to perform denial-of-service (DoS) attacks against the device, but in combination with CVE-2025-41666, CVE-2025-41667 or CVE-2025-41668 an adversary may gain full control over the device.
Are any updates or workarounds available? #
Phoenix Contact has released updates to fix these issues. Users are encouraged to update to the latest firmware version as quickly as possible.
- AXC F 1152 upgrade to firmware version 2025.0.2 or later
- AXC F 2152 upgrade to firmware version 2025.0.2 or later
- AXC F 3152 upgrade to firmware version 2025.0.2 or later
- BPC 9102S upgrade to firmware version 2025.0.2 or later
- RFC 4072S upgrade to firmware version 2025.0.2 or later
How do I find Phoenix Contact devices with runZero? #
From the Asset Inventory, use the following query to locate potentially impacted assets:
hw:="Phoenix Contact AXC F 1152" OR hw:="Phoenix Contact AXC F 2152" OR hw:="Phoenix Contact AXC F 3152" OR hw:="Phoenix Contact BPC 9102S" OR hw:="Phoenix Contact RFC 4072S"
