Phoenix Contact vulnerabilities
We track 103 vulnerabilities in Phoenix Contact products across 60+ products. 103 are rated high or critical, and none are known to be exploited. The most recent was published on November 4, 2026.
Latest Phoenix Contact vulnerabilities
- 7.8 High severity
AXC F 1152: Uncontrolled Search Path Element
A local user with low privileges may be able to influence the behavior of a privileged system service by manipulating configuration or application-related files located in user-writable areas of the filesystem. The affected service processes data from location
- 8.8 High severity
AXC F 1152: Improper Verification of Cryptographic Signature
The Web-based Management allows a remote low privileged Engineer user to install additional APPs on the device downloaded from the PLCnext Store without implementing any data verification mechanism, leading to the capability for an Engineer user to reach arbit
- 7.1 High severity
FL SWITCH 2005: Cross-Site Request Forgery
A CSRF vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker to trick authenticated users into sending unauthorized POST requests to the device by luring them to a malicious webpage. This can silently alter the
- 7.1 High severity
FL SWITCH 2005: Improper Neutralization of Input During Web Page Generation
A stored cross‑site scripting (XSS) vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker to create a trunk entry containing malicious HTML/JavaScript code. When the affected page is viewed, the injected script
- 7.2 High severity
FL SWITCH 2005: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability in the device’s Root CA certificate transfer workflow allows a high-privileged attacker to send crafted HTTP POST requests that result in arbitrary command execution on the underlying Linux OS with root privileges.
- 8.8 High severity
TC ROUTER 3002T-3G: Improper Control of Generation of Code
An unauthenticated remote attacker can trick a high privileged user into uploading a malicious payload via the config-upload endpoint, leading to code injection as root. This results in a total loss of confidentiality, availability and integrity due to imprope
- 7.1 High severity
FL SWITCH 2005: Improper Neutralization of Input During Web Page Generation
An XSS vulnerability in pxc_portSfp.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability doe
- 7.1 High severity
FL SWITCH 2005: Improper Neutralization of Input During Web Page Generation
An XSS vulnerability in pxc_portCntr.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability do
- 7.1 High severity
FL SWITCH 2005: Improper Neutralization of Input During Web Page Generation
An XSS vulnerability in pxc_PortCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability doe
- 7.1 High severity
FL SWITCH 2005: Improper Neutralization of Input During Web Page Generation
An XSS vulnerability in port_util.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does
- 7.1 High severity
FL SWITCH 2005: Improper Neutralization of Input During Web Page Generation
An XSS vulnerability in pxc_Dot1xCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability do
- 7.1 High severity
FL SWITCH 2005: Improper Neutralization of Input During Web Page Generation
An XSS vulnerability in pxc_vlanIntfCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerabil
- 7.1 High severity
FL SWITCH 2005: Improper Neutralization of Input During Web Page Generation
An XSS vulnerability in pxc_portSecCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerabili
- 7.1 High severity
FL SWITCH 2005: Improper Neutralization of Input During Web Page Generation
An XSS vulnerability in pxc_portCntr2.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerabilit
- 7.1 High severity
FL SWITCH 2005: Improper Neutralization of Input During Web Page Generation
An XSS vulnerability in dyn_conn.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerability doe
- 8.8 High severity
CHARX SEC-3150: Improper Control of Generation of Code
An low privileged remote attacker with an account for the Web-based management can change the system configuration to perform a command injection as root, resulting in a total loss of confidentiality, availability and integrity due to improper control of gener
- 8.8 High severity
AXC F 1152: Improper Link Resolution Before File Access
A low privileged remote attacker with file access can replace a critical file or folder used by the service security-profile to get read, write and execute access to any file on the device.
- 8.8 High severity
AXC F 1152: Improper Link Resolution Before File Access
A low privileged remote attacker with file access can replace a critical file used by the arp-preinit script to get read, write and execute access to any file on the device.
- 8.8 High severity
AXC F 1152: Improper Link Resolution Before File Access
A low privileged remote attacker with file access can replace a critical file used by the watchdog to get read, write and execute access to any file on the device after the watchdog has been initialized.
- 8.8 High severity
CHARX SEC-3150: Missing Authentication for Critical Functionality
An unauthenticated adjacent attacker can modify configuration by sending specific requests to an API-endpoint resulting in read and write access due to missing authentication.
- 8.2 High severity
CHARX SEC-3150: Buffer Copy without Checking Size of Input
An unauthenticated remote attacker can use MQTT messages to trigger out-of-bounds writes in charging stations complying with German Calibration Law, resulting in a loss of integrity for only EichrechtAgents and potential denial-of-service for these stations.
- 8.1 High severity
FL MGUARD 2102: Improper Control of Generation of Code
A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control or NAT through the FW_INCOMING.FROM_IP FW_INCOMING.IN_IP FW_OUTGOING.FROM_IP FW_OUTGOING.IN_IP FW_RU
- 8.1 High severity
FL MGUARD 2102: Improper Control of Generation of Code
A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control or NAT through the FW_INCOMING.FROM_IP FW_INCOMING.IN_IP FW_OUTGOING.FROM_IP FW_OUTGOING.IN_IP envir
- 8.1 High severity
FL MGUARD 2102: Improper Control of Generation of Code
A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control or NAT through the FW_PORTFORWARDING.SRC_IP environment variable which can lead to a DoS.
- 8.1 High severity
FL MGUARD 2102: Improper Control of Generation of Code
A low privileged remote attacker can perform configuration changes of the firewall services, including packet forwarding or NAT through the FW_NAT.IN_IP environment variable which can lead to a DoS.
- 8.1 High severity
FL MGUARD 2102: Improper Control of Generation of Code
A low privileged remote attacker can perform configuration changes of the ospf service through OSPF_INTERFACE.SIMPLE_KEY, OSPF_INTERFACE.DIGEST_KEY environment variables which can lead to a DoS.
- 8.8 High severity
FL MGUARD 2102: Improper Neutralization of Special Elements used in an OS Command
A low privileged remote attacker can read and write files as root due to improper neutralization of special elements in the variable EMAIL_RELAY_PASSWORD in mGuard devices.
- 8.8 High severity
FL MGUARD 2102: Improper Neutralization of Special Elements used in an OS Command
A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable EMAIL_NOTIFICATION.TO in mGuard devices.
- 8.8 High severity
FL MGUARD 2102: Improper Neutralization of Special Elements used in an OS Command
A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable PROXY_HTTP_PORT in mGuard devices.
- 9.8 Critical severity
CHARX SEC-3000: Use of Default Credentials
A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default password.
- 7.8 High severity
CHARX SEC-3000: Improper Neutralization of Special Elements used in a Command
A local attacker with low privileges can use a command injection vulnerability to gain root privileges due to improper input validation using the OCPP Remote service.
- 7.0 High severity
CHARX SEC-3000: Cleartext Transmission of Sensitive Information
An unauthenticated remote attacker can extract a session token with a MitM attack and gain web-based management access with the privileges of the currently logged in user due to cleartext transmission of sensitive information. No additional user interaction is
- 8.7 High severity
CHARX SEC-3000: Cleartext Transmission of Sensitive Information
An unauthenticated remote attacker can influence the communication due to the lack of encryption of sensitive data via a MITM. Charging is not affected.
- 7.5 High severity
CHARX SEC-3000: Access of Uninitialized Pointer
An unauthenticated remote attacker can DoS a control agent due to access of a uninitialized pointer which may prevent or disrupt the charging functionality.
- 7.8 High severity
An improper input validation in the Qualcom plctool allows a local attacker with low…
An improper input validation in the Qualcom plctool allows a local attacker with low privileges to gain root access by changing the ownership of specific files.
- 9.8 Critical severity
CHARX SEC-3000: Out-of-bounds Write
An unauthenticated remote attacker can write memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization.
- 7.5 High severity
CHARX SEC-3000: Out-of-bounds Read
An unauthenticated remote attacker can read memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization.
- 9.8 Critical severity
An unauthenticated remote attacker can modify configurations to perform a remote code…
An unauthenticated remote attacker can modify configurations to perform a remote code execution, gain root rights or perform an DoS due to improper input validation.
- 7.5 High severity
MULTIPROG: Download of Code Without Integrity Check
Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to download and execute applications without integrity checks on the device which may result in a
- 7.5 High severity
Automation Worx Software Suite: Download of Code Without Integrity Check
Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all applications on a PLC.