CVE-2025-41771: Phoenix Contact PLCnext SQL injection in notification endpoint

CVE-2025-41771 · Severity: medium · CVSS 4.3 · Published 2026-08-12

Phoenix Contact PLCnext is an industrial control platform used in manufacturing and critical infrastructure automation. An authenticated attacker with low privileges can execute SQL injection attacks against the notification system, potentially compromising the integrity of alerts and system monitoring. While the immediate impact is limited to notification functionality, SQL injection in industrial systems poses risk to operational visibility and could serve as a foothold for further attacks.

Technologies: Phoenix Contact AXC F 1152, Phoenix Contact EPC 1522. Vendors: Phoenix Contact.

Quick answers

Is CVE-2025-41771 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-41771 being exploited in the wild.
How severe is CVE-2025-41771?
Medium severity, with a CVSS score of 4.3, published 12 August 2026.
Which products and versions are affected?
Phoenix Contact AXC F 1152 <UNKNOWN>; Phoenix Contact Catan C1 <UNKNOWN>; Phoenix Contact EPC 1502 <UNKNOWN>; Phoenix Contact EPC 1522 <UNKNOWN>; and 1 more.
Is there a fix for CVE-2025-41771?
A patch was published on 2026-08-12: PLCnext firmware 2026.0.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-41771 attacked?
It is attacked over the network, in device firmware.
Am I affected by CVE-2025-41771?
Check whether you run Phoenix Contact AXC F 1152, Phoenix Contact Catan C1, Phoenix Contact EPC 1502 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an SQL injection flaw in an authenticated web interface endpoint of the PLCnext controller. The vulnerable component is a SQLite database used exclusively for storing notification messages. An attacker with low-privilege authenticated access can inject malicious SQL queries through improper input validation on this endpoint. The attack requires prior authentication and network access to the web interface; unauthenticated remote exploitation is not possible. Successful exploitation allows an attacker to read, modify, or delete notification records. Phoenix Contact has released firmware version 2026.0.3 and later to address this issue.

Affected products

  • Phoenix Contact PLCnext prior to 2026.0.3
  • Phoenix Contact Catan C1 <UNKNOWN>
  • Phoenix Contact EPC 1502 <UNKNOWN>
  • Phoenix Contact EPC 1522 <UNKNOWN>
  • Phoenix Contact AXC F 1152 <UNKNOWN>

Timeline

  • 2026-08-12: disclosed: PCSA-2025-00009 / VDE-2025-056 published
  • 2026-08-12: patched: PLCnext firmware 2026.0.3 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.