The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default…

CVE-2025-41769 is a classic buffer overflow (CWE-120: Buffer Copy without Checking Size of Input) in the PROFINET service of Phoenix Contact PLCnext firmware. The flaw exists in the default configuration — no special feature needs to be enabled. An unauthenticated attacker with network access to the PROFINET service (UDP 34962–34964 or Layer 2 Ethertype 0x8892) can send a crafted packet to reboot the controller or achieve arbitrary code execution. All PLCnext firmware versions prior to 2026.0.3 are affected across 15+ device models including AXC F 1152/2152/3152, BPC 9102S/9202S, EPC 1502/1522, RFC 4072R/4072S, and the virtual VPLCNEXT CONTROL line. The advisory (VDE-2025-056) was published alongside two sibling CVEs: CVE-2025-41770 (DoS on the Engineer communication interface, CVSS 7.5) and CVE-2025-41771 (authenticated SQLi, CVSS 4.3).

The vendor's CRITICAL / 9.8 score is accurate and appropriate. PROFINET is unauthenticated by protocol design, complexity is low, no user interaction is needed, and the impact spans confidentiality, integrity, and availability of a programmable logic controller — a device that directly governs physical processes. The only nuance the CVSS doesn't capture is that PROFINET traffic almost never traverses the public internet; it lives on the OT/plant LAN. But within that LAN, this is as weaponizable as it gets: point-and-shoot, pre-auth, default config, on a safety-critical device. The 9.8 stands.

Why this verdict

• Unauthenticated, zero-click, default-config RCE: The PROFINET service requires no credentials (protocol design), no user interaction, and the vulnerability exists in the default configuration. The CVSS 9.8 base score accurately reflects this.
• Role multiplier — PLCnext IS the high-value target: Every single PLCnext installation is an OT/ICS controller governing physical processes. This is not a workstation bug that *might* land on a DC — it is a PLC bug that *always* lands on a PLC. Compromise yields process disruption, safety interlock bypass, or sustained denial of control. The blast radius is operational/safety-critical. Per the high-value-role floor rule, the verdict floor is CRITICAL.
• OT network segmentation is the only friction, and it does not break the floor: Yes, PROFINET is rarely internet-exposed. But within the OT LAN — which is the documented attack vector — exploitation is trivial. OT network segmentation quality varies widely; converged IT/OT architectures, VPN access to OT zones, and compromised engineering workstations all provide adjacency. The friction adjusts the *likelihood* but does not reduce the *consequence*, which is physical-process compromise.
• Wormable within OT segments: PROFINET networks are flat Layer 2 segments. A single compromised PLC can attack all peers on the same segment, making this vulnerability self-propagating within the plant network.
• No workaround available: Phoenix Contact provides no compensating control or configuration change — the only remediation is firmware update to 2026.0.3, which requires planned downtime in OT environments.

Why not higher?

There is no severity above CRITICAL. A 9.8 CVSS is already the maximum practical score. If anything, the lack of a public PoC and the OT-network-only attack surface prevent escalation of urgency beyond the already-maximum severity bucket.

Why not lower?

Downgrading below CRITICAL would require evidence that the blast radius is contained or that the affected population is negligible. Neither applies: 100% of PLCnext installs are PLCs by definition (canonical high-value role), the attack is pre-auth and default-config, and compromise of a PLC has direct safety and operational consequences. The OT-network-adjacency requirement is real friction but is insufficient to break the CRITICAL floor for a canonical ICS/OT controller vulnerability — it only means the *path* is harder, not that the *consequence* is smaller.

1. Enforce IT/OT network segmentation immediately — Ensure PLCnext controllers reside on isolated OT network segments (Purdue Level 1–2) with no direct IP routing from IT networks. Deploy within 3 days per the noisgate mitigation SLA for CRITICAL findings. Use firewalls or unidirectional gateways to block all inbound traffic to PROFINET ports (UDP 34962–34964) from non-OT sources.
2. Block PROFINET from engineering VLANs where possible — If engineering workstations do not need direct PROFINET access (many use PLCnext Engineer over a separate management interface), ACL-restrict PROFINET ports to only the devices that require them. This limits lateral movement if an engineering workstation is compromised.
3. Deploy OT network monitoring — Install passive OT network sensors (Claroty, Nozomi Networks, Dragos, or similar) to detect anomalous PROFINET traffic, unexpected PLC reboots, and PLC-to-PLC scanning. Alert on any PROFINET RPC traffic from non-PLC source MACs.
4. Schedule firmware update to 2026.0.3 in next maintenance window — The only true remediation is the firmware update. OT firmware updates require planned downtime and testing. Begin validation in a staging environment immediately and target deployment within the next scheduled maintenance window, no later than 90 days per the noisgate remediation SLA.
5. Disable unnecessary network services on PLCnext — Review each controller's enabled services via the PLCnext web interface. Disable any services not required for operation (e.g., if PROFINET is not used and the controller communicates via OPC UA or Modbus TCP instead, disable the PROFINET stack entirely).

Run this script from any Linux or macOS host on the same network as the PLCnext controller. It connects to the PLCnext web management interface (HTTPS on port 443) to query the firmware version. Requires curl and network access to the PLC management IP. Usage: bash check_plcnext_cve2025_41769.sh <PLC_IP_ADDRESS>. No authentication required for the version endpoint.

#!/bin/bash
# check_plcnext_cve2025_41769.sh
# Checks Phoenix Contact PLCnext firmware version for CVE-2025-41769
# Usage: bash check_plcnext_cve2025_41769.sh <PLC_IP>
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 <PLC_IP_ADDRESS>"
  exit 2
fi

PLC_IP="$1"
FIXED_MAJOR=2026
FIXED_MINOR=0
FIXED_PATCH=3

# Attempt to retrieve firmware version from PLCnext web interface
RAW=$(curl -sk --connect-timeout 10 --max-time 15 "https://${PLC_IP}/wbm/api/system/info" 2>/dev/null || true)

if [ -z "$RAW" ]; then
  # Fallback: try HTTP
  RAW=$(curl -sk --connect-timeout 10 --max-time 15 "http://${PLC_IP}/wbm/api/system/info" 2>/dev/null || true)
fi

if [ -z "$RAW" ]; then
  echo "UNKNOWN - Could not connect to PLCnext at ${PLC_IP}"
  exit 2
fi

# Extract firmware version string (expected format: "2026.0.3" or similar)
FW_VERSION=$(echo "$RAW" | grep -oP '"firmwareVersion"\s*:\s*"\K[0-9]+\.[0-9]+\.[0-9]+' 2>/dev/null || true)

if [ -z "$FW_VERSION" ]; then
  # Try alternate JSON key
  FW_VERSION=$(echo "$RAW" | grep -oP '"version"\s*:\s*"\K[0-9]+\.[0-9]+\.[0-9]+' 2>/dev/null || true)
fi

if [ -z "$FW_VERSION" ]; then
  echo "UNKNOWN - Could not parse firmware version from response"
  echo "Raw response (first 500 chars): ${RAW:0:500}"
  exit 2
fi

echo "Detected PLCnext firmware version: ${FW_VERSION}"

# Parse version components
IFS='.' read -r MAJOR MINOR PATCH <<< "$FW_VERSION"

# Compare against fixed version 2026.0.3
if [ "$MAJOR" -gt "$FIXED_MAJOR" ] 2>/dev/null; then
  echo "PATCHED - Firmware ${FW_VERSION} is newer than fixed version ${FIXED_MAJOR}.${FIXED_MINOR}.${FIXED_PATCH}"
  exit 0
elif [ "$MAJOR" -eq "$FIXED_MAJOR" ] 2>/dev/null; then
  if [ "$MINOR" -gt "$FIXED_MINOR" ] 2>/dev/null; then
    echo "PATCHED - Firmware ${FW_VERSION} is newer than fixed version ${FIXED_MAJOR}.${FIXED_MINOR}.${FIXED_PATCH}"
    exit 0
  elif [ "$MINOR" -eq "$FIXED_MINOR" ] 2>/dev/null; then
    if [ "$PATCH" -ge "$FIXED_PATCH" ] 2>/dev/null; then
      echo "PATCHED - Firmware ${FW_VERSION} meets or exceeds fixed version ${FIXED_MAJOR}.${FIXED_MINOR}.${FIXED_PATCH}"
      exit 0
    fi
  fi
fi

echo "VULNERABLE - Firmware ${FW_VERSION} is below fixed version ${FIXED_MAJOR}.${FIXED_MINOR}.${FIXED_PATCH} (CVE-2025-41769)"
exit 1

Sources

1. CERT@VDE Advisory VDE-2025-056
2. Phoenix Contact PSIRT
3. Nozomi Networks — PLCnext Privilege Escalation Research
4. Nozomi Networks — Fuzzing P-Net PROFINET
5. PROFINET Port Reference
6. PLCHound — Internet-Exposed ICS Detection (SecurityWeek)
7. CERT@VDE Advisories Index