PLCnext Control EUVD-2025-209952

Exploitation requires an authenticated low-privileged Engineer-role account (CVSS PR:L) with network access to the Web-based Management interface, and the specific prerequisite feature is the PLCnext Store APP-install capability in WBM, which installs packages without integrity/signature verification. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The limiting factors that constrain real-world risk are: valid Engineer credentials must already be held (it is not fully unauthenticated), the WBM interface must be network-reachable to the attacker, and the device must be running firmware prior to 2026.0.3. There is no special non-default configuration called out beyond having the app-install function available, and exploitation is confined to the PLCnext Control product family listed in EUVD-2025-209952.

Signals conflict and should be weighed for an OT environment. CVSS 4.0 base score is 8.7 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N and high confidentiality, integrity and availability impact but no subsequent-system impact (SC:N/SI:N/SA:N) - i.e. network-reachable, low-complexity, no user interaction, but requiring an existing low-privileged Engineer account. EPSS is very low at 0.06% (18th percentile), there is no CISA KEV listing and no public exploit identified, which points to no observed broad exploitation rather than an imminent mass-exploitation threat. The realistic risk is elevated by context: these are PLCs/controllers where root code execution directly threatens process integrity and availability, and the prerequisite (a low-privileged Engineer account) is a relatively low bar inside an engineering network. An explicit SSVC decision (exploitation/automatable/technical-impact) was not provided in the input and is therefore not asserted here. Net: prioritize patching for internet- or widely-exposed WBM interfaces, while the low EPSS and absence of public PoC mean it is not a drop-everything emergency for well-segmented OT networks.

An attacker who has obtained or been granted a low-privileged Engineer account logs into the PLCnext Web-based Management interface over the network, then uses the PLCnext Store install function to push a maliciously modified APP package. Because the device performs no signature/integrity verification, the tampered package is installed and executes with root privileges, giving the attacker control of the PLC and the ability to disrupt the controlled process. No public proof-of-concept exploit is identified at time of analysis; the low attack complexity (AC:L) and lack of required user interaction make exploitation straightforward once Engineer-level access is held.