Read the docs
TI-2025-27630 Aliases CVE-2025-41665GHSA-x2c5-vc55-gpgh

Phoenix Contact: DoS of the PLC due to incorrect default permissions possible

Priority LOW 29CWE-276Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

An low privileged remote attacker can enforce the watchdog of the affected devices to reboot the PLC due to incorrect default permissions of a config file.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00361 30th percentileScored 2026-11-07
Fix Fixed AXC F 1152 (PHOENIX CONTACT): 2025.0.2AXC F 2152 (PHOENIX CONTACT): 2025.0.2+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Phoenix ContactAXC F 1152before 2025.0.22025.0.2Patch availableCNA
Phoenix ContactAXC F 2152before 2025.0.22025.0.2Patch availableCNA
Phoenix ContactAXC F 3152before 2025.0.22025.0.2Patch availableCNA
Phoenix ContactBPC 9102Sbefore 2025.0.22025.0.2Patch availableCNA
Phoenix ContactRFC 4072Sbefore 2025.0.22025.0.2Patch availableCNA
  • AXC F 1152 VendorPhoenix Contact Affected before 2025.0.2 Fixed in 2025.0.2 Patch available CNA
  • AXC F 2152 VendorPhoenix Contact Affected before 2025.0.2 Fixed in 2025.0.2 Patch available CNA
  • AXC F 3152 VendorPhoenix Contact Affected before 2025.0.2 Fixed in 2025.0.2 Patch available CNA
  • BPC 9102S VendorPhoenix Contact Affected before 2025.0.2 Fixed in 2025.0.2 Patch available CNA
  • RFC 4072S VendorPhoenix Contact Affected before 2025.0.2 Fixed in 2025.0.2 Patch available CNA

Remediation

  • Fix · CNA AXC F 1152 (PHOENIX CONTACT) Fixed in 2025.0.2
  • Fix · CNA AXC F 2152 (PHOENIX CONTACT) Fixed in 2025.0.2
  • Fix · CNA AXC F 3152 (PHOENIX CONTACT) Fixed in 2025.0.2
  • Fix · CNA BPC 9102S (PHOENIX CONTACT) Fixed in 2025.0.2
  • Fix · CNA RFC 4072S (PHOENIX CONTACT) Fixed in 2025.0.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    PHOENIX CONTACT AXC F 1152, AXC F 2152 and 3 more products 2025.0.2

    4 records Highest priority Priority MEDIUM 3 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2025-27633 Phoenix Contact: File access due to the replacement of a critical file used by the service security-profilePriority MEDIUM 41
    • TI-2025-27632 Phoenix Contact: File access due to the replacement of a critical file used by the arp-preinit scriptPriority MEDIUM 41
    • TI-2025-27631 Phoenix Contact: File access due to the replacement of a critical file used by the watchdogPriority MEDIUM 41
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-41665
  2. 2026-10-03 Alias added: GHSA-x2c5-vc55-gpgh

References

Other 1

  • TI-2014-07463 Phoenix Contact Software ProConOs and MultiProg Missing Authentication for Critical Function CVSS 2.0CRITICAL 10.0
  • TI-2024-17093 PHOENIX CONTACT: Remote code execution in CHARX Series CVSS 3.1CRITICAL 9.8
  • TI-2022-13692 Insufficient Verification of Data Vulnerability in PHOENIX CONTACT classic line industrial controllers CVSS 3.1CRITICAL 9.8
  • TI-2026-21959 Remote code execution via uploading a malicious IODD file CVSS 3.1CRITICAL 9.8
  • TI-2026-21940 Authentication Bypass in _account_log CVSS 3.1CRITICAL 9.8
  • TI-2023-03334 PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels CVSS 3.1CRITICAL 10.0
See all 194 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences