PLCnext Engineer vulnerabilities
3 known vulnerabilities in PLCnext Engineer from Phoenix Contact. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.4 High severity
PLCnext Engineer: Improper Limitation of a Pathname to a Restricted Directory
The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository. Archive entries containing relative path segments such as '..' are not rejected, allowing an unauthenticated local att
- 8.4 High severity
PLCnext Engineer: Download of Code Without Integrity Check
The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin repository and loads them via reflection, but the deployment routine processes archive entries that were never covered by the signature verificatio
- 8.8 High severity
AXC F 1152: Incorrect Permission Assignment for Critical Resource
A incorrect permission assignment for critical resource vulnerability in PLCnext products allows an remote attacker with low privileges to gain full access on the affected devices.