ICS Advisories

Risk evaluation

This advisory addresses security vulnerabilities in Phoenix Contact products with an integrated CodeMeter Runtime, like PLCnext devices and Virtual Controls. These security vulnerabilities only may occur with versions <8.41a of the integrated software CodeMeter Runtime from Wibu-Systems. Please see listed products to determine which devices and firmware versions are affected.

Mitigation summary

Please check the Phoenix Contact e-Shop regularly to see if the fixed firmware is already available for your specific PLCnext device or Virtual PLCnext Control. The Fix is planned to be integrated in version 2026.0.6 which is planned for Q4/2026.

Risk evaluation

This advisory addresses multiple security vulnerabilities in Phoenix Contact products using the software CodeMeter Runtime like licensed desktop software tools. These security vulnerabilities only may occur with CodeMeter Runtime 8.x versions <V8.41a and CodeMeter Runtime 9.x versions <9.10 from Wibu-Systems.

Mitigation summary

Updates for the affected products are planned for Q4 2026. Until the fix is available, please follow the mitigation measures and check the respective product page on the Phoenix Contact website regularly to see if the fix is already available.

Risk evaluation

GSDX SignatureValue verification, signed plug-in validation bypass and path traversal vulnerabilities have been identified in PLCnext Engineer prior to version 2026.6. The effects of these vulnerabilities may result in a complete loss of confidentiality, integrity and availability.

Mitigation summary

Phoenix Contact strongly recommends to upgrade to PLCnext Engineer 2026.6 which fixes these vulnerabilities.

Risk evaluation

The firmware of IOL MA8 EIP DI8 and IOL MA8 PN DI8 devices is affected by security vulnerabilities that can be used to bypass authentication. Code can be executed on the devices through command injection and local file inclusion. Path traversal and modified schemata can be used to read sensitive information such as password hashes or private keys from the devices.

Mitigation summary

Phoenix Contact strongly recommends to update affected devices to firmware version 1.7.8.

Risk evaluation

This advisory addresses multiple security vulnerabilities in PLCnext firmware versions prior to 2026.0.3. The vulnerabilities may allow unauthenticated attackers to cause denial of service, trigger unexpected system behavior, or execute unauthorized SQL queries. Successful exploitation could impact the availability, integrity, and confidentiality of affected PLCnext Control devices. All issues are resolved in PLCnext firmware version 2026.0.3.

Mitigation summary

Update to PLCnext firmware version 2026.0.3 or later which fixes this vulnerability. Check regularly for firmware updates and apply them as soon as they are available for the specific device.

Risk evaluation

Multiple vulnerabilities have been identified in the firmware of CHARX SEC-3xxx EV charging controllers, including the CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150 models. The flaws could allow attackers to compromise the devices remotely, resulting in a complete loss of confidentiality, integrity, and availability.

Mitigation summary

Phoenix Contact strongly recommends to upgrade to firmware version 1.9.1 which fixes these vulnerabilities.

Risk evaluation

VDE-2026-060: A unauthenticated log download vulnerability in the firmware of CHARX SEC-3xxx charging controllers has been discovered.

Mitigation summary

Phoenix Contact strongly recommends to upgrade to firmware version 1.9.0 which fixes these vulnerabilities.

Risk evaluation

This advisory addresses security issues in PLCnext firmware versions prior to 2026.0.3 that are related to APP handling and the processing of configuration files. The identified vulnerabilities affect APP installation authenticity as well as the handling of configuration data in writable directories. Successful exploitation may allow authenticated attackers with different privilege levels to compromise integrity, availability, and system security of affected PLCnext Control. Both issues are resolved starting with PLCnext firmware version 2026.0.3.

Mitigation summary

For firmware versions prior to 2026.0.3 apps are installed via WBM (APP Manager) without enforced authenticity validation. Verify the SHA-256 checksum provided by the PLCnext Store manually before installing an APP. Restrict WBM access to trusted IP ranges via the firewall and protect Engineer credentials. Monitor APP lifecycle security notifications locally or via a central Syslog server. If APPs are not required, disable the APP Manager service via the WBM System Services page to eliminate an unnecessary attack vector. Starting with firmware version 2026.0.3, APP signature verification is enabled by default and only signed apps can be installed.

Risk evaluation

Attacks are possible when installing key files and digitally signed objects. These attacks can only be carried out if these files are uploaded and installed by a logged-in user with high privileges.

Mitigation summary

Phoenix Contact strongly recommends to upload firmware only from trusted source and to thorougly check the SHA256 checksum of the firmware image to be uploaded.

Risk evaluation

Multiple vulnerabilities have been identified in the FL SWITCH 2xxx, FL SWITCH TSN 23xx and FL SWITCH 59xx firmware prior to version 3.53. One of these (CVE-2026-22317) enables an attacker to execute system commands as root user on the device. Five other vulnerabilities (CVE-2026-22316, CVE-2026-22318, CVE-2026-22319, CVE-2026-22320 and CVE-2026-22321) are related to Denial of Service (DoS) attacks, which partly limit the device's functionality. Another vulnerability (CVE-2026-22322) relates to reflected cross-site scripting in the web-based management of the device. And one vulnerability (CVE-2026-22323) relates to Cross‑Site Request Forgery in the web-based management of the device. All vulnerabilities have been resolved in firmware version 3.53.

Mitigation summary

Phoenix Contact strongly recommends to upgrade to firmware 3.53 which addresses this vulnerability and is available for download for all affected devices.

Risk evaluation

The OpenSSL library used in the affected products is vulnerable to an unbounded growth of the session cache in the TLSv1.3 implementation.

Mitigation summary

It is recommended to disable TCP encapsulation on affected mGuard devices and use Pathfinder instead.

Risk evaluation

A code injection vulnerability at the upload-config endpoint in the firmware of TC ROUTER and CLOUD CLIENT Industrial Mobile network routers has been discovered that can be exploited by an high privileged attacker.

Mitigation summary

As this vulnerability can only be exploited by an authenticated high privileged user, Phoenix Contact recommends to strictly restrict administrative access to the device. The administrative use shall only import configuration files from trusted sources.

Risk evaluation

Multiple vulnerabilities have been identified in the FL SWITCH 2xxx firmware prior to version 3.50. Two of these (CVE-2025-41692 and CVE-2025-41696) enable an attacker to access the device's file system. Two other vulnerabilities (CVE-2025-41693 and CVE-2025-41694) are related to Denial of Service (DoS) attacks, which partly limit the device's functionality. Another vulnerability (CVE-2025-41697) allows an unauthenticated physical attacker to access a login shell via an undocumented UART port. Furthermore, there are multiple vulnerabilities relating to reflected cross-site scripting in the web-based management of the device. All vulnerabilities have been resolved in firmware version 3.50.

Mitigation summary

Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

Risk evaluation

A vulnerability in the firmware of CHARX SEC-3xxx charging controllers has been discovered.

Mitigation summary

This product was designed for use in closed industrial networks. Phoenix Contact strongly recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our [application note](https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf).

Risk evaluation

Multiple vulnerabilities were discovered in the firmware of QUINT4-UPS EIP devices that can be used by an unauthenticated remote attacker to perform Denial of Service attacks and to gather login credentials for the Webfrontend.

Mitigation summary

This product was designed for use in closed industrial networks. Phoenix Contact strongly recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our [application note](https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf). In the industrial sector it is common practice to use Modbus/TCP without authentication.

Risk evaluation

Several CPUs manufactured by Intel, AMD or based on ARM technology may leak information due to their internal operation if attacked by specifically written software executed on the affected systems. The information in this advisory is based on the statements of respective manufacturers.

Mitigation summary

On Industrial PCs and HMIs that operate with user installable or upgradable operating systems (mainly Windows) the latest version or update may be installed if required in the use case. As the update may have a performance impact, the application should be tested accordingly.

Risk evaluation

The jq JSON processor, which is used to migrate firmware configurations in the product, contains 2 vulnerabilities that can be exploited by an authenticated attacker.

Mitigation summary

Phoenix Contact strongly recommends upgrading affected mGuard devices to firmware version 1.8.1 or higher which fixes this vulnerability.

Risk evaluation

A local privilege escalation vulnerability in Phoenix Contact products utilizing WIBU-SYSTEMS CodeMeter Runtime allows users to gain admin rights on freshly installed systems. The CodeMeter Control Center starts with elevated privileges and retains them until restarted, enabling unauthorized access to admin tools like cmd.exe.

Mitigation summary

PHOENIX CONTACT strongly recommends affected users to upgrade to CodeMeter V8.30a, which fixes these vulnerabilities. WIBU-SYSTEMS has already published this update for CodeMeter on their homepage. Since this current version of CodeMeter V8.30a has not yet been incorporated into Phoenix Contact products, we strongly recommend to download and install the current CodeMeter version directly from the WIBU-SYSTEMS homepage. Additional Recommendations: Regularly check the product's official webpage for updated release versions that support CodeMeter V8.30a. Update the Activation Wizard to version 1.8 as soon as it becomes available on the product's download page.

Risk evaluation

Start sequence for firewall service allows attack during the boot process. Password is reset to default when the device undergoes a firmware upgrade.

Mitigation summary

Phoenix Contact strongly recommends upgrading affected charge controllers to firmware version 1.6.3 or higher which fixes these vulnerabilities.

Risk evaluation

Confidential data in HTTP query string of user requests. Incomplete sanitation of user input in administrative web interface.

Mitigation summary

Read access to the device via administrative interfaces should be granted only to trustworthy users.