Which versions of PLCnext Control are affected by CVE-2025-41769?

Phoenix Contact PLCnext industrial controllers (AXC F, RFC, BPC, VPLCnext, EPC families) face critical risk from unauthenticated remote code execution and denial-of-service attacks via a buffer…. A patch is available.

How to fix or mitigate CVE-2025-41769?

Within 24 hours: Inventory all deployed Phoenix Contact PLCnext controllers (AXC F 1152/1252/2152/3152, RFC 4072R/S, BPC 9102S/9202S, VPLCnext Control, EPC 15xx series) and confirm PROFINET service status in production environments; implement firewall rules restricting PROFINET (UDP/TCP port 34962) access to authorized engineering stations only and isolate controllers to separate network segments. Within 7 days: Contact Phoenix Contact support for patch timeline and request interim mitigation guidance; deploy network monitoring rules to detect suspicious PROFINET traffic; assess operational criticality of each affected controller and develop risk-ranked remediation priorities. Within 30 days: Deploy network intrusion detection signatures targeting buffer overflow patterns on PROFINET; conduct functional testing of any vendor-released workarounds or patches immediately upon availability; evaluate device replacement timelines for mission-critical controllers if patch delays extend beyond 60 days.

PLCnext Control CVE-2025-41769

Q: What is the CVSS score of CVE-2025-41769?

CVE-2025-41769 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 59.0%.

EUVD-2025-210705 CRITICAL

Classic Buffer Overflow (CWE-120)

2026-08-12 CERTVDE

GHSA-9v55-xwh5-8wv7

Buffer Overflow RCE Axc F 1152 Axc F 1252 Axc F 2152 Axc F 3152 Bpc 9102S Bpc 9202S Rfc 4072R Rfc 4072S Vl3 Upc 2440 Edge Vplcnext Control 1000 Vplcnext Control 2000 Vplcnext Control 3000 Vplcnext Control 500 Epc 1502 Epc 1522

9.3

CVSS 4.0 · Vendor: CERTVDE

Severity by source

Vendor (CERTVDE) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

PROFINET flaw reachable in default config with no auth or interaction gives AV:N/AC:L/PR:N/UI:N; buffer-overflow RCE yields C/I/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CERTVDE).

CVSS VectorVendor: CERTVDE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 12, 2026 - 09:16 EUVD

Analysis Generated

Aug 12, 2026 - 08:37 vuln.today

CVE Published

Aug 12, 2026 - 08:05 cve.org

CRITICAL 9.3

DescriptionCVE.org

The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default configuration. An unauthenticated remote attacker could exploit this vulnerability to reboot the device or execute arbitrary code.

AnalysisAI

Remote code execution and denial-of-service in Phoenix Contact PLCnext-family industrial controllers (AXC F 1152/1252/2152/3152, RFC 4072R/S, BPC 9102S/9202S, VPLCnext Control, EPC 15xx and others) arise from a buffer overflow in the PROFINET service that is reachable in the default configuration. An unauthenticated remote attacker on the network can crash/reboot the device or execute arbitrary code, per the vendor CVSS 4.0 rating of 9.3 (critical). This is a CWE-120 classic buffer overflow reported by CERT@VDE; no public exploit identified at time of analysis and it is not on CISA KEV.

Technical ContextAI

The affected devices are Phoenix Contact PLCnext-based programmable logic controllers and industrial edge/IPC devices used in OT/ICS automation. The flaw is CWE-120 (Buffer Copy without Checking Size of Input, a classic buffer overflow) in the PROFINET service - the real-time industrial Ethernet protocol these controllers use for field-device communication and cyclic I/O exchange. Because PROFINET is a core operational service enabled by default on these controllers, the vulnerable code path parses attacker-influenced network input without adequate bounds checking, allowing memory corruption that can be steered from a device reboot (DoS) up to arbitrary code execution. CPE data confirms the affected line spans phoenix_contact axc_f_1152/1252/2152/3152, bpc_9102s/9202s, rfc_4072r/4072s, vl3_upc_2440_edge and vplcnext_control_1000, with tags extending coverage to VPLCnext Control 500/2000/3000 and EPC 1502/1522.

RemediationAI

Obtain the fixed firmware from Phoenix Contact's CERT@VDE CSAF advisory VDE-2025-056 (https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2025-056.json) and update each affected controller to the vendor-specified patched version - the exact fix version is not present in the provided data and must be read from that advisory. Because the PROFINET service is enabled by default and disabling it breaks core automation/I/O functionality, the primary compensating control is network segmentation: place these controllers on an isolated OT/PROFINET VLAN with no routing to enterprise or internet networks, and enforce a firewall/access-control list so only trusted engineering stations and required PROFINET peers can reach the device (trade-off: mis-scoped rules can disrupt legitimate cyclic PROFINET traffic). Additionally restrict physical and logical access to the control network, monitor for unexpected device reboots as a possible exploitation indicator, and follow Phoenix Contact/CERT@VDE defense-in-depth guidance for PLCnext deployments until firmware can be updated during a maintenance window.