EUVD-2025-210707
GHSA-vr3r-mcqv-4cmg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable web endpoint requires low-privilege authentication; scope unchanged and impact limited to notification database integrity with no confidentiality or availability loss.
Primary rating from Vendor (CERTVDE).
CVSS VectorVendor: CERTVDE
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification functionality.
AnalysisAI
SQL injection in Phoenix Contact PLCnext controller web interfaces exposes a notification message SQLite database to manipulation by authenticated low-privilege users. The vulnerable endpoint is network-accessible with no attack requirements beyond a valid low-privilege account, making it trivially exploitable from any networked workstation in OT environments where such accounts exist. Impact is deliberately bounded by design to the notification subsystem - core PLC control logic, I/O, and safety functions are not affected - but notification tampering in industrial contexts may suppress or falsify operational alerts. No public exploit code exists and no CISA KEV listing is present at time of analysis.
Technical ContextAI
The affected products are Phoenix Contact PLCnext-family industrial programmable logic controllers and edge computing platforms, spanning AXC F (1152, 1252, 2000 EA, 2152, 3152), BPC (9102S, 9202S), RFC (4072R, 4072S), VL3 UPC 2440 Edge, VPLCnext Control 500/1000/2000/3000, Catan C1, and EPC (1502, 1522). These devices expose a web management interface for configuration and monitoring. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) identifies the root cause: user-supplied input is incorporated into SQL queries without adequate parameterization or escaping. The backend target is a SQLite embedded database used exclusively to store notification messages, isolating the attack surface from the primary real-time control database or firmware storage.
RemediationAI
No specific patched firmware version is confirmed from available intelligence; the CSAF advisory (VDE-2025-056) at https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2025-056.json should be consulted directly for patch availability and target firmware versions from Phoenix Contact. As compensating controls pending a patch: restrict access to the PLCnext web management interface to dedicated management VLANs or jump hosts, preventing general network access to the vulnerable endpoint - trade-off is reduced operational convenience for remote access. Audit and minimize low-privilege web interface accounts, removing any accounts that do not have a documented operational need, reducing the pool of potential attackers. If the notification web endpoint can be disabled or rate-limited via controller configuration without impacting operations, consider doing so as a temporary measure.
More in Axc F 1152
View allRemote code execution and denial-of-service in Phoenix Contact PLCnext-family industrial controllers (AXC F 1152/1252/21
Unauthenticated remote denial-of-service in Phoenix Contact's PLCnext Engineer communication interface allows any networ
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today