Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware

An attacker with low-level credentials on a PLCnext controller could manipulate configuration files and create symbolic link exploits to gain full system access or remotely force the PLC to reboot, disrupting manufacturing processes and equipment control.

Manufacturing facilities using Phoenix Contact PLCnext controllers (AXC F series and RFC/BPC models) are affected. Any site running these as primary logic controllers for process automation, motor control, or safety-critical functions should prioritize assessment and patching.

An attacker with low-privilege user credentials (or obtained through weak password/social engineering) logs into the PLCnext web interface or SSH service. The attacker creates malicious symbolic links or modifies configuration files accessed by system services like the watchdog, arp-preinit, or security-profile. These services run with elevated privileges and execute the attacker's modified configuration, allowing code execution or denial of service.