Security Advisory

CVE-2025-41769: Phoenix Contact PLCnext Control Unauthenticated PROFINET Buffer Overflow

Last updated:
  • CVE-2025-41769
Not indexed yetThis page does not yet have enough independently analysed data (no NVD CVSS/CPE assessment, and it is not in the CISA KEV catalog) to publish as a reviewed advisory, so it is marked noindex and left out of the sitemap until more data is confirmed.

CVE-2025-41769 is a critical buffer overflow (CWE-120) in the PROFINET service that Phoenix Contact ships on its PLCnext Control family of industrial PLCs and controllers: in the devices' default configuration, an unauthenticated remote attacker can send crafted network traffic to the PROFINET service to reboot the controller or execute arbitrary code on it, and NVD has not yet published its own CVSS score for the flaw.

Vulnerability summary

N/A

Not yet scored

0.8%

EPSS score (FIRST)

No

CISA KEV catalog

2026-08-12

Published

Vulnerability ID: CVE-2025-41769 · Source: NVD

Affected components

ComponentCPEVersion range
Phoenix Contact PLCnext Control family (AXC F, RFC 4072R/S, BPC 9102S/9202S, EPC 1502/1522, VPLCNEXT CONTROL 500/1000/2000/3000, VL3 UPC 2440 EDGE, Catan C1)cpe:2.3:h:phoenix_contact:axc_f_2152:*:*:*:*:*:*:*:*PLCnext firmware 2019.0.4 up to but not including 2026.0.3 (fixed in 2026.0.3)

What does this mean for affected devices?

CVE-2025-41769 (CWE-120, classic buffer overflow) affects the PROFINET industrial-Ethernet service built into Phoenix Contact's PLCnext Control firmware. CERT@VDE's coordinated advisory VDE-2025-056 describes it plainly: "The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default configuration. An unauthenticated remote attacker could exploit this vulnerability to reboot the device or execute arbitrary code" (CERT@VDE VDE-2025-056).

PLCnext Control devices are physical, DIN-rail-mounted industrial PLCs: the affected product list in the advisory's machine-readable CSAF data identifies them with hardware CPEs (cpe:2.3:h:phoenix_contact:...) spanning the AXC F 1152/1252/2000 EA/2152/3152 controllers, RFC 4072R/4072S remote field controllers, BPC 9102S/9202S box PCs, EPC 1502/1522 edge PCs, the VPLCNEXT CONTROL 500/1000/2000/3000 line, VL3 UPC 2440 EDGE and Catan C1 (CERT@VDE CSAF for VDE-2025-056).

VDE-2025-056 bundles three vulnerabilities discovered by CyberDanube and coordinated through CERT@VDE, rating the bundle's aggregate severity "Critical": CVE-2025-41769 (this PROFINET buffer overflow, CVSS v3.1 9.8), CVE-2025-41770 (an unauthenticated denial-of-service in the PLCnext Engineer communication interface, CVSS v3.1 7.5), and CVE-2025-41771 (a low-privilege SQL injection limited to the device's notification-message SQLite database, CVSS v3.1 4.3). The advisory's own impact note states the vulnerabilities together "allow an unauthenticated remote attacker to cause a denial-of-service condition, trigger unexpected behaviour through a buffer overflow, or execute unauthorized SQL queries against affected PLCnext devices" (CERT@VDE VDE-2025-056).

NVD tracks CVE-2025-41769 with status "Deferred" as of 2026-08-13: it records only a CERT@VDE-submitted score (source [email protected]) — CVSS v3.1 9.8 (critical, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CVSS v4.0 9.3 (critical) — both typed Secondary rather than an NVD-published Primary rating, so this page does not show a headline severity score rather than presenting that figure as NVD-confirmed (NVD).

Phoenix Contact's remediation for all three CVEs in the bundle is to update affected devices to PLCnext firmware version 2026.0.3 or later, and the vendor's general recommendation is to operate network-capable devices in closed networks or behind a suitable firewall rather than exposing the PROFINET service directly (CERT@VDE CSAF for VDE-2025-056).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.00838 (57.956th percentile) as of 2026-11-06 (CISA KEV, FIRST EPSS).

NVD has not finished its own severity analysis. In the meantime, PLCnext Control operators should update to firmware 2026.0.3 or later and isolate the PROFINET service from untrusted networks rather than relying on default configuration settings.

How to fix this class of issueThis advisory's weakness class is Memory corruption. Our practical guide covers how to detect, fix, verify and disclose it: How to fix memory corruption in embedded firmware.

Evidence

  • In the default configuration, an unauthenticated remote attacker can exploit a PROFINET service buffer overflow on PLCnext Control devices to reboot the device or execute arbitrary code (CWE-120). — CERT@VDE VDE-2025-056
  • Affected products are physical PLCnext Control hardware (hardware CPEs): AXC F 1152/1252/2000 EA/2152/3152, RFC 4072R/4072S, BPC 9102S/9202S, EPC 1502/1522, VPLCNEXT CONTROL 500/1000/2000/3000, VL3 UPC 2440 EDGE, Catan C1; vulnerable firmware 2019.0.4 up to but not including 2026.0.3. — CERT@VDE CSAF for VDE-2025-056
  • VDE-2025-056 bundles CVE-2025-41769 (buffer overflow, CVSS v3.1 9.8), CVE-2025-41770 (unauthenticated DoS in PLCnext Engineer communication, CVSS v3.1 7.5) and CVE-2025-41771 (low-privilege SQL injection limited to the notification SQLite database, CVSS v3.1 4.3), discovered by CyberDanube and coordinated by CERT@VDE; aggregate severity rated Critical. — CERT@VDE VDE-2025-056
  • NVD status is "Deferred" with a CERT@VDE-sourced Secondary CVSS v3.1 9.8 and CVSS v4.0 9.3; no NVD-published Primary score as of 2026-08-13. — NVD
  • Remediation is to update to PLCnext firmware 2026.0.3 or later; Phoenix Contact's general recommendation is to operate network-capable devices in closed networks or behind a firewall. — CERT@VDE CSAF for VDE-2025-056
  • Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.00838 (57.956th percentile) as of 2026-11-06. — FIRST EPSS

Questions about this page?

hello@softwsp.com Chat with David on WhatsApp

Check if your firmware is affected

Get a firmware scan reportTrack this CVEChat with David on WhatsApp

Related advisories

CVE-2025-48965: Mbed TLS ASN.1 Named-Data NULL Pointer Dereference via Crafted Certificate Strings — CVSS 7.5, High severityCVE-2025-48965: Mbed TLS before 3.6.4 can leave an internal ASN.1 named-data list in an inconsistent state after mbedtls_asn1_store_named_data() is called with a zero-length value for an OID already in the list, leaving a NULL pointer with a nonzero recorded length; later use dereferences that NULL pointer. NVD CVSS v3.1 7.5 (high); Mbed TLS itself rates it Medium. Fixed in 3.6.4.CVE-2025-53521: F5 BIG-IP APM Stack Buffer Overflow RCE (KEV, Reclassified from DoS) — CVSS 9.8, Critical severityCISA KEVCVE-2025-53521: KEV stack-based buffer overflow in F5 BIG-IP Access Policy Manager's apmd process, reclassified from DoS to remote code execution after active exploitation. Versions, fix guidance, scoring sourced to NVD, F5 and CISA.CVE-2026-102073: Siemens APOGEE/TALON Building Automation Web Service Flaw (pending)CVE-2026-102073: an unvalidated input-length check in the web service of Siemens APOGEE and TALON building-automation controllers lets an unauthenticated remote attacker read device memory or cause denial of service. NVD has not yet completed its analysis.

Sources

  1. NVD
  2. CERT@VDE VDE-2025-056
  3. CERT@VDE CSAF for VDE-2025-056
  4. CISA KEV
  5. FIRST EPSS