Which versions of PLCnext Engineer are affected by EUVD-2025-210706?

Phoenix Contact's PLCnext Engineer communication interface contains a critical denial-of-service vulnerability (CVE-2025-41770, CVSS 8.7) that allows unauthenticated attackers to interrupt…. A patch is available.

How to fix or mitigate EUVD-2025-210706?

Within 24 hours, implement network segmentation restricting PLCnext Engineer client access to production controllers, limiting connections to authorized engineering workstations and trusted network segments only. Within 7 days, conduct a complete inventory of your Phoenix Contact PLCnext deployments and versions; contact Phoenix Contact directly to confirm patch availability timelines and request interim mitigation guidance; and establish enhanced monitoring for connection anomalies and service disruptions. Within 30 days, implement access control policies enforcing authentication or IP-based restrictions for PLCnext Engineer connections where supported, develop and test a rapid service restart procedure to minimize recovery time, and evaluate deployment of redundant engineering access paths to critical systems.

PLCnext Engineer EUVD-2025-210706

Q: What is the CVSS score of EUVD-2025-210706?

EUVD-2025-210706 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 39.0%.

| CVE-2025-41770 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-08-12 CERTVDE

GHSA-89p8-vj9j-4m5c

Denial Of Service Axc F 1152 Axc F 1252 Axc F 2000 Ea Axc F 2152 Axc F 3152 Bpc 9102S Bpc 9202S Rfc 4072R Rfc 4072S Vl3 Upc 2440 Edge Vplcnext Control 1000 Vplcnext Control 2000 Vplcnext Control 3000 Vplcnext Control 500 Catan C1 Epc 1502 Epc 1522

8.7

CVSS 4.0 · Vendor: CERTVDE

Severity by source

Vendor (CERTVDE) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-accessible unauthenticated DoS with no confidentiality or integrity impact; scope unchanged as only the PLCnext communication service is disrupted.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CERTVDE).

CVSS VectorVendor: CERTVDE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 12, 2026 - 09:16 EUVD

Analysis Generated

Aug 12, 2026 - 08:36 vuln.today

CVE Published

Aug 12, 2026 - 08:06 cve.org

HIGH 8.7

DescriptionCVE.org

An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an remote attacker to interrupt access via the client application. Successful exploitation prevents communication until the PLCnext service is manually restarted.

AnalysisAI

Unauthenticated remote denial-of-service in Phoenix Contact's PLCnext Engineer communication interface allows any network-accessible attacker to interrupt engineering access to a broad range of Phoenix Contact industrial controllers. Exploitation triggers CWE-770 resource exhaustion in the PLCnext service, causing it to stop accepting connections from the PLCnext Engineer client application. Recovery requires a manual service restart - an operationally significant constraint in industrial environments where unplanned downtime carries physical and safety implications. No public exploit code is known, and the vulnerability is not listed in CISA KEV at time of analysis.

Technical ContextAI

The PLCnext Engineer communication interface is the protocol endpoint through which Phoenix Contact's engineering software connects to PLCnext-family controllers for programming, configuration, diagnostics, and monitoring. CWE-770 (Allocation of Resources Without Limits or Throttling) indicates the service does not impose adequate constraints on inbound connection attempts, message queues, or similar consumable resources, enabling an attacker to exhaust service capacity without authentication. Affected hardware confirmed by CPE data includes the AXC F 1152, AXC F 1252, AXC F 2000 EA, AXC F 2152, and AXC F 3152 controllers; BPC 9102S and BPC 9202S panel PCs; RFC 4072R and RFC 4072S remote field controllers; and the VL3 UPC 2440 Edge. Advisory tags additionally identify vPLCnext Control 500, 1000, 2000, and 3000 virtual controllers, Catan C1, EPC 1502, and EPC 1522. All CPE entries carry unbounded version wildcards, indicating no version floor or ceiling has been established in available data. These devices run Phoenix Contact's Linux-based PLCnext runtime, which hosts both the real-time PLC engine and the engineering communication service as separate processes.

RemediationAI

Consult the Phoenix Contact CSAF advisory VDE-2025-056 at https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2025-056.json for authoritative patch guidance; no specific fixed firmware or software version was derivable from the available input data, so patch status cannot be independently confirmed without reviewing the full advisory. As an immediate compensating control, restrict network access to the PLCnext Engineer communication port using an industrial firewall or ACL so that only authorized engineering workstation IP addresses can reach the interface - this directly prevents unauthenticated remote exploitation. Note that overly broad firewall rules may disrupt legitimate remote engineering workflows, so changes should be coordinated with operations teams and tested during a maintenance window. Additionally, deploy network-based anomaly detection to alert on abnormal connection volume to PLCnext engineering ports, enabling rapid detection and manual restart before extended operational impact occurs.