OTPulse
FeedAboutContact

Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware

Act Now9.8VDE-2025-053Jul 8, 2025
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

Multiple vulnerabilities in Phoenix Contact PLCnext firmware affect AXC F 1152, AXC F 2152, AXC F 3152, RFC 4072S, and BPC 9102S controllers. Vulnerabilities include resource exhaustion, path traversal, denial of service, memory corruption, command injection, and unsafe operations in underlying Linux components. A remote, unauthenticated attacker could execute arbitrary code, modify files, or crash the controller.

What this means
What could happen
An attacker could run arbitrary commands on affected PLCnext controllers without authentication, potentially modifying program logic, altering process setpoints, or stopping production operations entirely. These controllers are critical to manufacturing automation and any compromise could halt facility operations.
Who's at risk
Manufacturing facilities using Phoenix Contact PLCnext automation controllers (AXC F 1152, AXC F 2152, AXC F 3152, RFC 4072S, BPC 9102S) as primary process controllers. This includes discrete manufacturing, automotive, chemical, food & beverage, and any facility relying on these controllers for production line management or critical operations.
How it could be exploited
An attacker with network access to the PLCnext controller could send a specially crafted request to exploit one of the multiple vulnerabilities in the Linux components. No authentication is required; the attack could come from anywhere on your network or (if the device is internet-facing) from the internet.
Prerequisites
  • Network reachability to the affected PLCnext controller
  • No authentication required
remotely exploitableno authentication requiredlow complexityhigh EPSS score (62.7%)affects critical manufacturing controllersmultiple vulnerability types (code execution, path traversal, DoS, memory corruption)
Exploitability
High exploit probability (EPSS 62.7%)
Affected products (5)
5 with fix
ProductAffected VersionsFix Status
AXC F 1152<2025.0.22025.0.2
AXC F 2152<2025.0.22025.0.2
AXC F 3152<2025.0.22025.0.2
RFC 4072S<2025.0.22025.0.2
BPC 9102S<2025.0.22025.0.2
Remediation & Mitigation
0/4
Do now
0/1
WORKAROUNDRestrict network access to PLCnext controllers by implementing firewall rules to block traffic from untrusted networks
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

HOTFIXUpdate all affected PLCnext controllers to firmware version 2025.0.2 or later
HOTFIXUpdate PLCnext Engineer software to the latest version
Long-term hardening
0/1
HARDENINGSegment PLCnext controllers on a dedicated OT network isolated from general IT and internet access
View full CERT@VDE advisory
API: /api/v1/advisories/00cff1b0-0bc1-4bb9-8992-52301d62742e