CVE-2025-41770
Unauthenticated Denial of Service
- State
- Published
- Severity
- 8.7 High
- Published
- Aug 12, 2026
- Updated
- Aug 12, 2026
- Reserved
- Apr 16, 2025
Description
An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an remote attacker to interrupt access via the client application. Successful exploitation prevents communication until the PLCnext service is manually restarted.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | CERTVDE |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | CERTVDE |
Weaknesses
- CWE-770 Allocation of Resources Without Limits or Throttling
Affected Products
| Product | Versions |
|---|---|
AXC F 1152Phoenix Contact |
|
AXC F 1252Phoenix Contact |
|
AXC F 2000 EAPhoenix Contact |
|
AXC F 2152Phoenix Contact |
|
AXC F 3152Phoenix Contact |
|
BPC 9102SPhoenix Contact |
|
BPC 9202SPhoenix Contact |
|
RFC 4072RPhoenix Contact |
|
RFC 4072SPhoenix Contact |
|
VL3 UPC 2440 EDGEPhoenix Contact |
|
VPLCNEXT CONTROL 1000Phoenix Contact |
|
VPLCNEXT CONTROL 2000Phoenix Contact |
|
VPLCNEXT CONTROL 3000Phoenix Contact |
|
VPLCNEXT CONTROL 500Phoenix Contact |
|
Catan C1Phoenix Contact |
|
EPC 1502Phoenix Contact |
|
EPC 1522Phoenix Contact |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.