Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 7

Export CSV
CVE-2026-110935

Path traversal in plug-in deployment

The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository. Archive entries containing relative path segments such as '..' are not rejected, allowing an unauthenticated local attacker to write files outside the plugin repository to arbitrary locations accessible with the current user's permissions which could result in full system compromise.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Phoenix Contact Phoenixcontact
Products
Plcnext Engineer Plcnext Engineer
CVE-2026-110022

Signed plug-in validation bypass

The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin repository and loads them via reflection, but the deployment routine processes archive entries that were never covered by the signature verification. An unauthenticated local attacker can replace an unsigned DLL outside the signed prefix in the archive passes verification and overwrites the legitimate signed assembly at the same destination path. The plugin loader then instantiates the attacker-supplied code without any additional integrity check resulting in a full compromise of the affected systems.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Phoenix Contact Phoenixcontact
Products
Plcnext Engineer Plcnext Engineer
CVE-2026-110021

Missing GSDX SignatureValue verification

PLCnext Engineer checks GSDX manifest reference digests but does not cryptographically verify the XML `SignatureValue` over canonicalized `SignedInfo`. An unauthenticated local attacker can modify signed GSDML content, update its manifest digest, retain the public certificate data, and leave an invalid nonempty `SignatureValue`. PLCnext Engineer prior to 2026.6 reports the package as `Valid` and selects the modified device description for import under the default policy.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Phoenix Contact Phoenixcontact
Products
Plcnext Engineer Plcnext Engineer
CVE-2023-46144

PHOENIX CONTACT: PLCnext Control prone to download of code without integrity check

A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with low privileges to compromise integrity on the affected engineering station and the connected devices.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Phoenixcontact
Products
Axc F 1152 Axc F 1152 Firmware Axc F 2152 and 14 more
CVE-2023-46142

PHOENIX CONTACT: Insufficient Read and Write Protection to Logic and Runtime Data in PLCnext Control

A incorrect permission assignment for critical resource vulnerability in PLCnext products allows an remote attacker with low privileges to gain full access on the affected devices.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Phoenixcontact
Products
Axc F 1152 Axc F 1152 Firmware Axc F 2152 and 14 more
CVE-2020-12499

PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and earlier: Improper path sanitation vulnerability.

In PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and earlier an improper path sanitation vulnerability exists on import of project files.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Phoenixcontact
Products
Plcnext Engineer