CVE-2025-41717

Config-Upload Code Injection

State: Published
Severity: 8.8 High
Published: Jan 13, 2026
Updated: Feb 5, 2026
Reserved: Apr 16, 2025

Description

An unauthenticated remote attacker can trick a high privileged user into uploading a malicious payload via the config-upload endpoint, leading to code injection as root. This results in a total loss of confidentiality, availability and integrity due to improper control of code generation ('Code Injection’).

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	CERTVDE

Weaknesses

CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

Product	Versions
TC ROUTER 3002T-3GPhoenix Contact	0.0.0 to before 3.08.8Affected
TC ROUTER 2002T-3GPhoenix Contact	0.0.0 to before 3.08.8Affected
TC ROUTER 3002T-4GPhoenix Contact	0.0.0 to before 3.08.8Affected
TC ROUTER 3002T-4G GLPhoenix Contact	0.0.0 to before 3.08.8Affected
TC ROUTER 5004T-5G EUPhoenix Contact	0.0.0 to before 1.06.23Affected
TC ROUTER 3002T-4G VZWPhoenix Contact	0.0.0 to before 3.08.8Affected
TC ROUTER 3002T-4G ATTPhoenix Contact	0.0.0 to before 3.08.8Affected
TC ROUTER 2002T-4GPhoenix Contact	0.0.0 to before 3.08.8Affected
CLOUD CLIENT 1101T-TX/TXPhoenix Contact	0.0.0 to before 3.07.7Affected
TC CLOUD CLIENT 1002-4G ATTPhoenix Contact	0.0.0 to before 3.08.8Affected
TC CLOUD CLIENT 1002-TX/TXPhoenix Contact	0.0.0 to before 3.07.7Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.