Phoenix Contact WBM CVE-2025-41699

Exploitation requires a valid low-privileged account on the device's Web-based management (HTTP/HTTPS) interface - this authentication requirement (PR:L) is the primary limiting factor and means the attacker must already have, or obtain, credentials. Once authenticated, the attacker triggers the flaw by changing the system configuration, so the specific precondition is write access to configuration settings through the web UI that feed into code/command generation. Practical risk is further bounded by whether the management interface is network-exposed (versus isolated on an OT segment) and by how tightly low-privilege accounts are provisioned; devices on segregated networks with no untrusted low-tier accounts face materially lower exposure. No special non-default feature toggle is named in the description.

This is a genuinely serious flaw that warrants prioritization, though not an emergency on exploitation-probability grounds alone. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring only a low-privileged authenticated account on the Web-based management interface, yielding full root-level command injection (C:H/I:H/A:H) - hence the 8.8 HIGH rating. The decisive mitigating signal is the privilege requirement: PR:L means an attacker must already possess valid (even low-tier) credentials, so this is a privilege-escalation-to-root rather than a pre-auth takeover. The EPSS score of 0.85% (57th percentile) is low-to-moderate, indicating no evidence of broad automated exploitation activity to date, which is consistent with there being no KEV listing and no identified public exploit. The signals are therefore internally consistent: high technical impact but gated behind authentication, with no active-exploitation or POC evidence. Net: treat as a high-priority patch for any exposed or multi-user Phoenix Contact device, but it is not a drop-everything pre-auth RCE. Note the SSVC framework data (exploitation status, automatable, technical impact) was NOT provided in the input and cannot be factored in; the EPSS percentile is the only exploitation-likelihood signal available.

A user holding a low-privileged account on the device's Web-based management interface authenticates, then abuses a configuration setting that improperly passes attacker-controlled input into code/command generation, injecting commands that execute as root. No victim interaction is required (UI:N) and the attack is network-reachable, but valid credentials are a prerequisite. No public exploit code has been identified at time of analysis.