Loading story…
Phoenix Contact industrial devices are affected by CVE-2025-41769, a critical unauthenticated buffer overflow in the default PROFINET service configuration that can let a remote attacker on a reachable network reboot devices or execute arbitrary code by sending crafted PROFINET packets. The flaw carries a CVSS v3.1 score of 9.8 and CVSS v4.0 score of 9.3, with impact spanning confidentiality, integrity, and availability in operational technology environments.
Affected product lines include AXC F, BPC, RFC, EPC, PLCnext Control, VL3 UPC EDGE, and VPLCNEXT CONTROL devices, with impacted firmware versions reported from 2019.0.4 and fixes identified as 2026.0.3 or later for listed models, though one report said no vendor patch timeline had yet been announced. Recommended mitigations include updating firmware where available, disabling PROFINET if not required, segmenting OT networks, restricting and filtering PROFINET access and related EtherType traffic, monitoring for anomalous PROFINET activity, and inventorying exposed devices. No public proof-of-concept or active exploitation was reported at publication.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
On August 12, 2026, CVE-2025-41769 was published as a critical unauthenticated buffer overflow in the default PROFINET service configuration of multiple Phoenix Contact devices. The flaw can be exploited remotely to reboot devices or achieve arbitrary code execution.
The vulnerability affects listed Phoenix Contact devices from version 2019.0.4 up to versions earlier than 2026.0.3, indicating version 2026.0.3 or later contains the fix. The sources identify AXC F, BPC, RFC, VL3 UPC EDGE, PLCnext Control, and EPC product lines as affected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Siemens RUGGEDCOM ROX industrial networking devices contain a **critical** OS command injection flaw, tracked as `CVE-2025-40949`, in the Scheduler function of the Web UI. The vulnerability stems from improper input validation in the task scheduling backend, allowing an authenticated remote attacker to inject arbitrary commands and execute them with **root privileges** on the underlying operating system. The issue carries a **CVSS v3.1 score of 9.1** and was reported by researchers at the Palo Alto Networks OT Threat Research Lab. Affected products include multiple Siemens RUGGEDCOM ROX lines, including **MX5000**, **MX5000RE**, **RX1400**, **RX1500-series**, **RX1536**, and **RX5000** devices running versions earlier than **2.17.1**. CISA republished Siemens ProductCERT guidance urging organizations to upgrade to fixed releases, restrict network exposure, and follow Siemens industrial security recommendations to reduce the risk of exploitation in operational technology environments.
Jun 29, 2026
CERT@VDE disclosed two **CVSS 9.8** vulnerabilities in 15 IO-Link industrial master models from Pepperl+Fuchs, Phoenix Contact, and Carlo Gavazzi Automation. `CVE-2026-27546` is an authentication-bypass flaw in the `_account_log` function that can grant an unauthenticated attacker an administrator session, while `CVE-2026-27565` is an IODD-file processing command-injection flaw that enables unauthenticated root-level command execution and can persist a malicious script on the device. Affected products include Pepperl+Fuchs ICE2 and ICE3 series devices, Phoenix Contact IOL MA8 EIP DI8 and IOL MA8 PN DI8 models, and Carlo Gavazzi YL212 and YN115 models running firmware earlier than `1.7.4`. The Canadian Centre for Cyber Security advises organizations to apply firmware `1.7.4` and follow vendor guidance; administrators should isolate management interfaces and restrict IODD uploads until remediation is complete. No public exploit or CISA Known Exploited Vulnerabilities catalog listing was reported at disclosure.
Sep 16, 2026
CISA republished Mitsubishi Electric advisories for two **high-severity denial-of-service vulnerabilities** affecting industrial control products in the **MELSEC iQ-F Series**. The flaws impact the **FX5-EIP EtherNet/IP Module** (`CVE-2026-8805`) and the **FX5-ENET/IP Ethernet Module** (`CVE-2026-8806`), both used in critical manufacturing environments. In the FX5-EIP module, a remotely reachable integer overflow in the EtherNet/IP function can be triggered by rapidly opening many TCP connections, leading to inconsistent connection handling and improper memory access. In the FX5-ENET/IP module, an expected-behavior violation can be exploited by flooding the Ethernet port with a large volume of packets, overloading processing and stopping communications while disabling internal anomaly-detection processing. CISA and Mitsubishi rated both issues **High** severity, with `CVE-2026-8806` carrying a **CVSS v4.0 score of 8.7** and affecting **all versions** of the FX5-ENET/IP module, while `CVE-2026-8805` affects **version 1.000 and earlier** of the FX5-EIP module. Recommended mitigations include applying vendor fixes where available, minimizing network exposure, isolating control systems behind firewalls, restricting access with segmentation and secure remote connectivity such as updated VPNs, and monitoring for abnormal traffic or excessive connection attempts. The disclosures follow earlier CISA advisories involving Mitsubishi MELSEC networking components, including an authentication-bypass issue in the **WS Series** Ethernet interface module (`CVE-2023-1618`).
Jul 12, 2026