Read the docs
TI-2025-27633 Aliases CVE-2025-41668GHSA-cfp6-pp5w-4v4g

Phoenix Contact: File access due to the replacement of a critical file used by the service security-profile

Priority MEDIUM 41CWE-59Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A low privileged remote attacker with file access can replace a critical file or folder used by the service security-profile to get read, write and execute access to any file on the device.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00602 49th percentileScored 2026-11-07
Fix Fixed AXC F 1152 (PHOENIX CONTACT): 2025.0.2AXC F 2152 (PHOENIX CONTACT): 2025.0.2+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Phoenix ContactAXC F 1152before 2025.0.22025.0.2Patch availableCNA
Phoenix ContactAXC F 2152before 2025.0.22025.0.2Patch availableCNA
Phoenix ContactAXC F 3152before 2025.0.22025.0.2Patch availableCNA
Phoenix ContactBPC 9102Sbefore 2025.0.22025.0.2Patch availableCNA
Phoenix ContactRFC 4072Sbefore 2025.0.22025.0.2Patch availableCNA
  • AXC F 1152 VendorPhoenix Contact Affected before 2025.0.2 Fixed in 2025.0.2 Patch available CNA
  • AXC F 2152 VendorPhoenix Contact Affected before 2025.0.2 Fixed in 2025.0.2 Patch available CNA
  • AXC F 3152 VendorPhoenix Contact Affected before 2025.0.2 Fixed in 2025.0.2 Patch available CNA
  • BPC 9102S VendorPhoenix Contact Affected before 2025.0.2 Fixed in 2025.0.2 Patch available CNA
  • RFC 4072S VendorPhoenix Contact Affected before 2025.0.2 Fixed in 2025.0.2 Patch available CNA

Remediation

  • Fix · CNA AXC F 1152 (PHOENIX CONTACT) Fixed in 2025.0.2
  • Fix · CNA AXC F 2152 (PHOENIX CONTACT) Fixed in 2025.0.2
  • Fix · CNA AXC F 3152 (PHOENIX CONTACT) Fixed in 2025.0.2
  • Fix · CNA BPC 9102S (PHOENIX CONTACT) Fixed in 2025.0.2
  • Fix · CNA RFC 4072S (PHOENIX CONTACT) Fixed in 2025.0.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    PHOENIX CONTACT AXC F 1152, AXC F 2152 and 3 more products 2025.0.2

    4 records Highest priority Priority MEDIUM 3 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2025-27632 Phoenix Contact: File access due to the replacement of a critical file used by the arp-preinit scriptPriority MEDIUM 41
    • TI-2025-27631 Phoenix Contact: File access due to the replacement of a critical file used by the watchdogPriority MEDIUM 41
    • TI-2025-27630 Phoenix Contact: DoS of the PLC due to incorrect default permissions possiblePriority LOW 29
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-41668
  2. 2026-10-03 Alias added: GHSA-cfp6-pp5w-4v4g

References

Other 1

  • TI-2014-07463 Phoenix Contact Software ProConOs and MultiProg Missing Authentication for Critical Function CVSS 2.0CRITICAL 10.0
  • TI-2024-17093 PHOENIX CONTACT: Remote code execution in CHARX Series CVSS 3.1CRITICAL 9.8
  • TI-2022-13692 Insufficient Verification of Data Vulnerability in PHOENIX CONTACT classic line industrial controllers CVSS 3.1CRITICAL 9.8
  • TI-2026-21959 Remote code execution via uploading a malicious IODD file CVSS 3.1CRITICAL 9.8
  • TI-2026-21940 Authentication Bypass in _account_log CVSS 3.1CRITICAL 9.8
  • TI-2023-03334 PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels CVSS 3.1CRITICAL 10.0
See all 194 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences