CVE-2025-41770
An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an remote attacker to interrupt access via the client application. Successful exploitation prevents communication until the PLCnext service is manually restarted.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.7
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.41%
- CWE
- CWE-770
- Published
- 2026-08-12
- Last modified
- 2026-08-12
Affected products
- Phoenix Contact AXC F 1152
- Phoenix Contact AXC F 1252
- Phoenix Contact AXC F 2000 EA
- Phoenix Contact AXC F 2152
- Phoenix Contact AXC F 3152
- Phoenix Contact BPC 9102S
- Phoenix Contact BPC 9202S
- Phoenix Contact RFC 4072R
Weakness type
Related vulnerabilities
- CVE-2026-1168 — Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2025-14871 — Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2026-88878 — Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass
- CVE-2026-82439 — Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC
- CVE-2026-72684 — Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service
- CVE-2026-74878 — openssl_encrypt before 1.4.0 TOTP Rate Limiter Bypass
- CVE-2026-77337 — CakePHP: Potential Authentication bypass with CookieAuthenticator
- CVE-2026-79921 — amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload