Phoenix Contact vulnerabilities
We track 103 vulnerabilities in Phoenix Contact products across 60+ products. 103 are rated high or critical, and none are known to be exploited. The most recent was published on November 4, 2026.
Latest Phoenix Contact vulnerabilities
- 8.4 High severity
PLCnext Engineer: Improper Limitation of a Pathname to a Restricted Directory
The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository. Archive entries containing relative path segments such as '..' are not rejected, allowing an unauthenticated local att
- 8.4 High severity
PLCnext Engineer: Download of Code Without Integrity Check
The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin repository and loads them via reflection, but the deployment routine processes archive entries that were never covered by the signature verificatio
- 9.8 Critical severity
ICE2-8IOL1-G65L-V1D: Improper Neutralization of Special Elements used in an OS Command
An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains active even after a reboot.
- 7.2 High severity
ICE2-8IOL1-G65L-V1D: Improper Neutralization of Special Elements used in an OS Command
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin credentials allowing execution of commands with root privileges on the device.
- 7.2 High severity
ICE2-8IOL1-G65L-V1D: Improper Neutralization of Special Elements used in an OS Command
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device.
- 7.2 High severity
ICE2-8IOL1-G65L-V1D: Improper Neutralization of Special Elements used in an OS Command
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials allowing execution of commands with root privileges on the device.
- 7.2 High severity
ICE2-8IOL1-G65L-V1D: Improper Neutralization of Special Elements used in an OS Command
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device.
- 7.2 High severity
ICE2-8IOL1-G65L-V1D: Improper Neutralization of Special Elements used in an OS Command
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credentials allowing execution of commands with root privileges on the device.
- 8.8 High severity
ICE2-8IOL1-G65L-V1D: Improper Neutralization of Special Elements used in an OS Command
A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device.
- 8.8 High severity
ICE2-8IOL1-G65L-V1D: Improper Neutralization of Special Elements used in an OS Command
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files endpoint using operator credentials allowing execution of commands with root privileges on the device.
- 7.5 High severity
ICE2-8IOL1-G65L-V1D: Path Traversal: '.../...//'
An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint allowing the SSH server's private keys to be read.
- 8.8 High severity
ICE2-8IOL1-G65L-V1D: Improper Control of Filename for Include/Require Statement in PHP Program
A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device.
- 8.8 High severity
ICE2-8IOL1-G65L-V1D: Improper Control of Filename for Include/Require Statement in PHP Program
A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device.
- 8.8 High severity
ICE2-8IOL1-G65L-V1D: Improper Neutralization of Special Elements used in an OS Command
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using operator credentials allowing execution of commands with root privileges on the device.
- 8.1 High severity
ICE2-8IOL1-G65L-V1D: Incorrect Authorization
A low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devices_tab/do_upload endpoint to upload IODD files to the device, potentially altering device behavior or causing system crashes.
- 8.8 High severity
ICE2-8IOL1-G65L-V1D: Improper Neutralization of Special Elements used in an OS Command
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing execution of commands with root privileges on the device.
- 8.8 High severity
ICE2-8IOL1-G65L-V1D: Improper Neutralization of Special Elements used in an OS Command
A low-privileged remote attacker can exploit a command injection vulnerability in the Field_Shadow_Password class using operator credentials allowing execution of commands with root privileges on the device.
- 8.8 High severity
ICE2-8IOL1-G65L-V1D: Improper Neutralization of Special Elements used in an OS Command
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/do_upload endpoint using operator credentials allowing execution of commands with root privileges on the device.
- 8.8 High severity
ICE2-8IOL1-G65L-V1D: Improper Neutralization of Special Elements used in an OS Command
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using user or operator credentials allowing execution of commands with root privileges on the device.
- 8.8 High severity
ICE2-8IOL1-G65L-V1D: Improper Neutralization of Special Elements used in an OS Command
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_menu_info endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device.
- 9.8 Critical severity
ICE2-8IOL1-G65L-V1D: Authentication Bypass Using an Alternate Path or Channel
An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accounts are properly configured.
- 7.5 High severity
AXC F 1152: Allocation of Resources Without Limits or Throttling
An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an remote attacker to interrupt access via the client application. Successful exploitation prevents communication until the PLCnext service is man
- 9.8 Critical severity
AXC F 1152: Buffer Copy without Checking Size of Input
The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default configuration. An unauthenticated remote attacker could exploit this vulnerability to reboot the device or execute arbitrary code.
- 9.8 Critical severity
CHARX SEC-3150: Improper Neutralization of Special Elements used in a Command
Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subsequently executed as root.
- 9.8 Critical severity
CHARX SEC-3150: Incorrect Behavior Order
Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system shutdown. This creates a temporary window in which internal services may become externally accessible, potentially allowing an unauthenticated
- 7.5 High severity
CHARX SEC-3150: Exposed Dangerous Method or Function
A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enabled by opening the port that CharxModbusServer is listening, an unauthenticated attacker can perform a Denial-of-Service
- 7.8 High severity
CHARX SEC-3150: Improper Neutralization of Special Elements used in an OS Command
A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.
- 9.8 Critical severity
CHARX SEC-3150: Improper Verification of Cryptographic Signature
The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a modified firmware, resulting in full system co
- 9.8 Critical severity
CHARX SEC-3150: Missing Authentication for Critical Functionality
Due to missing authentication the CHARX OCPP Agent service allows an unauthenticated remote attacker to reconfigure the backend connection. This can lead to Denial-of-Service and confidential data being disclosed to the attacker.
- 9.4 Critical severity
CHARX SEC-3150: Missing Authentication for Critical Functionality
The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to disclosure of charging point UIDs, Denial-of-Service and files tampering.
- 7.8 High severity
CHARX SEC-3150: Improper Neutralization of Special Elements used in an OS Command
A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.
- 8.6 High severity
CHARX SEC-3150: Improper Neutralization of Special Elements used in an OS Command
This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulting in the execution of arbitrary commands as the limited user charx-oa. Charging could be interrupted
- 7.1 High severity
CHARX SEC-3150: Unrestricted Upload of File with Dangerous Type
A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent storage of attacker-controlled files and potentially exhausting resources, which might lead to Denia
- 7.8 High severity
CHARX SEC-3150: Improper Neutralization of Special Elements used in an OS Command
A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full system compromise.
- 7.8 High severity
CHARX SEC-3150: Improper Neutralization of Special Elements used in an OS Command
A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.
- 8.6 High severity
CHARX SEC-3150: Not Failing Securely
An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including default credentials. This could allow the attacker to gain SSH access to the system as an unprivileged user "user-app". Char
- 7.8 High severity
CHARX SEC-3150: Improper Neutralization of Special Elements used in an OS Command
A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.
- 9.1 Critical severity
CHARX SEC-3150: Improper Neutralization of CRLF Sequences
An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss.
- 9.1 Critical severity
CHARX SEC-3150: Trust Boundary Violation
An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system configuration. This may lead to integrity and availability loss.
- 9.8 Critical severity
CHARX SEC-3150: Missing Authentication for Critical Functionality
Due to missing authentication, an unauthenticated remote attacker may access the MQTT broker, which is only protected from external access by a firewall. This may lead to the device being fully compromised.