Read the docs
TI-2025-27670 Aliases CVE-2025-41707GHSA-c75x-9xmc-g626

Phoenix Contact: WebSocket Handler Denial of Service

Priority LOW 27CWE-120Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the issue without affecting the core functionality.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01414 72nd percentileScored 2026-11-07
Fix Fixed QUINT4-UPS/24DC/24DC/5/EIP (Phoenix Contact): VC:07QUINT4-UPS/24DC/24DC/10/EIP (Phoenix Contact): VC:07+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Phoenix ContactQUINT4-UPS/24DC/24DC/5/EIPVC:00 to before VC:07VC:07Patch availableCNA
Phoenix ContactQUINT4-UPS/24DC/24DC/10/EIPVC:00 to before VC:07VC:07Patch availableCNA
Phoenix ContactQUINT4-UPS/24DC/24DC/20/EIPVC:00 to before VC:07VC:07Patch availableCNA
Phoenix ContactQUINT4-UPS/24DC/24DC/40/EIPVC:00 to before VC:07VC:07Patch availableCNA
  • QUINT4-UPS/24DC/24DC/5/EIP VendorPhoenix Contact Affected VC:00 to before VC:07 Fixed in VC:07 Patch available CNA
  • QUINT4-UPS/24DC/24DC/10/EIP VendorPhoenix Contact Affected VC:00 to before VC:07 Fixed in VC:07 Patch available CNA
  • QUINT4-UPS/24DC/24DC/20/EIP VendorPhoenix Contact Affected VC:00 to before VC:07 Fixed in VC:07 Patch available CNA
  • QUINT4-UPS/24DC/24DC/40/EIP VendorPhoenix Contact Affected VC:00 to before VC:07 Fixed in VC:07 Patch available CNA

Remediation

  • Fix · CNA QUINT4-UPS/24DC/24DC/5/EIP (Phoenix Contact) Fixed in VC:07
  • Fix · CNA QUINT4-UPS/24DC/24DC/10/EIP (Phoenix Contact) Fixed in VC:07
  • Fix · CNA QUINT4-UPS/24DC/24DC/20/EIP (Phoenix Contact) Fixed in VC:07
  • Fix · CNA QUINT4-UPS/24DC/24DC/40/EIP (Phoenix Contact) Fixed in VC:07

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Phoenix Contact QUINT4-UPS/24DC/24DC/10/EIP, QUINT4-UPS/24DC/24DC/20/EIP and 2 more products VC:07

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2025-27668 Phoenix Contact: WebSocket Message Interception Leaks Webfrontend CredentialsPriority LOW 30
    • TI-2025-27669 Phoenix Contact: Webserver Denial of Service through Malformed Content-LengthPriority LOW 27
    • TI-2025-27667 Phoenix Contact: Unauthenticated Modbus Service DoS via Crafted Function CodePriority LOW 27
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-41707
  2. 2026-10-03 Alias added: GHSA-c75x-9xmc-g626

References

Other 1

  • TI-2014-07463 Phoenix Contact Software ProConOs and MultiProg Missing Authentication for Critical Function CVSS 2.0CRITICAL 10.0
  • TI-2024-17093 PHOENIX CONTACT: Remote code execution in CHARX Series CVSS 3.1CRITICAL 9.8
  • TI-2022-13692 Insufficient Verification of Data Vulnerability in PHOENIX CONTACT classic line industrial controllers CVSS 3.1CRITICAL 9.8
  • TI-2026-21959 Remote code execution via uploading a malicious IODD file CVSS 3.1CRITICAL 9.8
  • TI-2026-21940 Authentication Bypass in _account_log CVSS 3.1CRITICAL 9.8
  • TI-2023-03334 PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels CVSS 3.1CRITICAL 10.0
See all 194 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences