Phoenix Contact vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-41770 An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an remote attacker to interrupt access via theHigh 8.7 · Aug 12, 2026
• CVE-2025-41769 The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default configuration.Critical 9.3 · Aug 12, 2026
• CVE-2026-7849 Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subseqCritical 9.3 · Jul 30, 2026
• CVE-2026-44108 Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system shutdown.Critical 9.3 · Jul 30, 2026
• CVE-2026-44107 A reboot of the charging controller can be triggered via Modbus TCP without authentication.High 8.7 · Jul 30, 2026
• CVE-2026-44106 A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resultinHigh 8.5 · Jul 30, 2026
• CVE-2026-44104 The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification.Critical 9.3 · Jul 30, 2026
• CVE-2026-44101 Due to missing authentication the CHARX OCPP Agent service allows an unauthenticated remote attacker to reconfigure the backend connection.Critical 9.3 · Jul 30, 2026
• CVE-2026-44100 The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points.High 8.8 · Jul 30, 2026
• CVE-2026-44099 A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full sysHigh 8.5 · Jul 30, 2026
• CVE-2026-44098 This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resultinHigh 8.8 · Jul 30, 2026
• CVE-2026-44096 A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full system compromise.High 8.5 · Jul 30, 2026
• CVE-2026-44095 A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commands as root, resultHigh 8.5 · Jul 30, 2026
• CVE-2026-44094 An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including default credentials.High 8.3 · Jul 30, 2026
• CVE-2026-44093 A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, reHigh 8.5 · Jul 30, 2026
• CVE-2026-44092 An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT.High 8.8 · Jul 30, 2026
• CVE-2026-44091 An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system configuration.High 8.8 · Jul 30, 2026
• CVE-2026-44090 Due to missing authentication, an unauthenticated remote attacker may access the MQTT broker, which is only protected from external access by a firewall.Critical 9.3 · Jul 30, 2026
• CVE-2026-41032 It is possible for an unauthenticated adjacent attacker to download log files of the controller, which may disclose some restricted information.High 7.5 · Jun 3, 2026
• CVE-2025-41670 A local user with low privileges may be able to influence the behavior of a privileged system service by manipulating configuration or application-related filesHigh 8.7 · May 27, 2026
• CVE-2025-41669 The Web-based Management allows a remote low privileged Engineer user to install additional APPs on the device downloaded from the PLCnext Store without implemeHigh 8.7 · May 27, 2026
• CVE-2024-43384 A low privileged remote attacker can gain the root password due to improper removal of sensitive information before storage or transfer.High 8 · May 7, 2026
• CVE-2026-22323 A CSRF vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker to trick authenticated users into sending unauthoHigh 7.1 · Mar 18, 2026
• CVE-2026-22322 A stored cross‑site scripting (XSS) vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker to create a trunk enHigh 7.1 · Mar 18, 2026
• CVE-2026-22317 A command injection vulnerability in the device’s Root CA certificate transfer workflow allows a high-privileged attacker to send crafted HTTP POST requests thaHigh 7.2 · Mar 18, 2026