Read the docs
TI-2025-27631 Aliases CVE-2025-41666GHSA-6hjq-rgp4-842x

Phoenix Contact: File access due to the replacement of a critical file used by the watchdog

Priority MEDIUM 41CWE-59Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A low privileged remote attacker with file access can replace a critical file used by the watchdog to get read, write and execute access to any file on the device after the watchdog has been initialized.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00602 49th percentileScored 2026-11-07
Fix Fixed AXC F 1152 (PHOENIX CONTACT): 2025.0.2AXC F 2152 (PHOENIX CONTACT): 2025.0.2+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Phoenix ContactAXC F 1152before 2025.0.22025.0.2Patch availableCNA
Phoenix ContactAXC F 2152before 2025.0.22025.0.2Patch availableCNA
Phoenix ContactAXC F 3152before 2025.0.22025.0.2Patch availableCNA
Phoenix ContactBPC 9102Sbefore 2025.0.22025.0.2Patch availableCNA
Phoenix ContactRFC 4072Sbefore 2025.0.22025.0.2Patch availableCNA
  • AXC F 1152 VendorPhoenix Contact Affected before 2025.0.2 Fixed in 2025.0.2 Patch available CNA
  • AXC F 2152 VendorPhoenix Contact Affected before 2025.0.2 Fixed in 2025.0.2 Patch available CNA
  • AXC F 3152 VendorPhoenix Contact Affected before 2025.0.2 Fixed in 2025.0.2 Patch available CNA
  • BPC 9102S VendorPhoenix Contact Affected before 2025.0.2 Fixed in 2025.0.2 Patch available CNA
  • RFC 4072S VendorPhoenix Contact Affected before 2025.0.2 Fixed in 2025.0.2 Patch available CNA

Remediation

  • Fix · CNA AXC F 1152 (PHOENIX CONTACT) Fixed in 2025.0.2
  • Fix · CNA AXC F 2152 (PHOENIX CONTACT) Fixed in 2025.0.2
  • Fix · CNA AXC F 3152 (PHOENIX CONTACT) Fixed in 2025.0.2
  • Fix · CNA BPC 9102S (PHOENIX CONTACT) Fixed in 2025.0.2
  • Fix · CNA RFC 4072S (PHOENIX CONTACT) Fixed in 2025.0.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    PHOENIX CONTACT AXC F 1152, AXC F 2152 and 3 more products 2025.0.2

    4 records Highest priority Priority MEDIUM 3 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2025-27633 Phoenix Contact: File access due to the replacement of a critical file used by the service security-profilePriority MEDIUM 41
    • TI-2025-27632 Phoenix Contact: File access due to the replacement of a critical file used by the arp-preinit scriptPriority MEDIUM 41
    • TI-2025-27630 Phoenix Contact: DoS of the PLC due to incorrect default permissions possiblePriority LOW 29
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-41666
  2. 2026-10-03 Alias added: GHSA-6hjq-rgp4-842x

References

Other 1

  • TI-2014-07463 Phoenix Contact Software ProConOs and MultiProg Missing Authentication for Critical Function CVSS 2.0CRITICAL 10.0
  • TI-2024-17093 PHOENIX CONTACT: Remote code execution in CHARX Series CVSS 3.1CRITICAL 9.8
  • TI-2022-13692 Insufficient Verification of Data Vulnerability in PHOENIX CONTACT classic line industrial controllers CVSS 3.1CRITICAL 9.8
  • TI-2026-21959 Remote code execution via uploading a malicious IODD file CVSS 3.1CRITICAL 9.8
  • TI-2026-21940 Authentication Bypass in _account_log CVSS 3.1CRITICAL 9.8
  • TI-2023-03334 PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels CVSS 3.1CRITICAL 10.0
See all 194 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences