Vulnerability-Lookup

VDE-2025-072

Vulnerability from csaf_phoenixcontactgmbhcokg - Published: 2025-10-14 06:00 - Updated: 2025-10-14 06:00

Summary

Phoenix Contact: Security Advisory for QUINT4-UPS EIP

Severity

High

Notes

Summary: Multiple vulnerabilities were discovered in the firmware of QUINT4-UPS EIP devices that can be used by an unauthenticated remote attacker to perform Denial of Service attacks and to gather login credentials for the Webfrontend.

Impact: A successful attack can lead to Denial of Service or exposure of credentials.

Mitigation: Affected devices are designed and developed for the use in closed industrial networks. Phoenix Contact therefore strongly recommends using the devices exclusively in closed networks and protected by a suitable firewall.

Remediation: Starting with version VC:07, all newly shipped devices will include firmware updates that address four vulnerabilities: CVE-2025-41704, CVE-2025-41705, CVE-2025-41706, and CVE-2025-41707. However, configuration of devices via unauthenticated Modbus/TCP remains possible in VC:07, as this protocol is a widely used standard in the industrial sector. As a result, VC:07 is still affected by CVE-2025-41703.

Product description: Uninterruptible power supplies with an EIP interface.

General Recommendation: For general information and recommendations on security measures to protect network-enabled devices, refer to the application note: [Application Note Security](https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf).

CVE-2025-41703

An unauthenticated remote attacker can cause a Denial of Service by turning off the output of the UPS via Modbus command.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-306 - Missing Authentication for Critical Function

Mitigation This product was designed for use in closed industrial networks. Phoenix Contact strongly recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our [application note](https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf). In the industrial sector it is common practice to use Modbus/TCP without authentication.

Affected products

Known affected 8 products

Product	Identifier	Version	Remediation
QUINT4-UPS/24DC/24DC/5/EIP VC:00<VC:07 Phoenix Contact / Hardware / QUINT4-UPS/24DC/24DC/5/EIP	`2906994`	VC:00<VC:07	No Fix Planned
QUINT4-UPS/24DC/24DC/10/EIP VC:00<VC:07 Phoenix Contact / Hardware / QUINT4-UPS/24DC/24DC/10/EIP	`2907069`	VC:00<VC:07	No Fix Planned
QUINT4-UPS/24DC/24DC/20/EIP VC:00<VC:07 Phoenix Contact / Hardware / QUINT4-UPS/24DC/24DC/20/EIP	`2907074`	VC:00<VC:07	No Fix Planned
QUINT4-UPS/24DC/24DC/40/EIP VC:00<VC:07 Phoenix Contact / Hardware / QUINT4-UPS/24DC/24DC/40/EIP	`2907080`	VC:00<VC:07	No Fix Planned
QUINT4-UPS/24DC/24DC/5/EIP VC:07 Phoenix Contact / Hardware / QUINT4-UPS/24DC/24DC/5/EIP	`2906994`	VC:07	No Fix Planned
QUINT4-UPS/24DC/24DC/10/EIP VC:07 Phoenix Contact / Hardware / QUINT4-UPS/24DC/24DC/10/EIP	`2907069`	VC:07	No Fix Planned
QUINT4-UPS/24DC/24DC/20/EIP VC:07 Phoenix Contact / Hardware / QUINT4-UPS/24DC/24DC/20/EIP	`2907074`	VC:07	No Fix Planned
QUINT4-UPS/24DC/24DC/40/EIP VC:07 Phoenix Contact / Hardware / QUINT4-UPS/24DC/24DC/40/EIP	`2907080`	VC:07	No Fix Planned

CVE-2025-41704

An unauthanticated remote attacker can perform a DoS of the Modbus service by sending a specific function and sub-function code without affecting the core functionality.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-770 - Allocation of Resources Without Limits or Throttling

Vendor Fix Starting with VC:07 the affected devices will be shipped with a fixed firmware.

Affected products

Fixed 4 products

Product	Identifier	Version
QUINT4-UPS/24DC/24DC/5/EIP VC:07 Phoenix Contact / Hardware / QUINT4-UPS/24DC/24DC/5/EIP	`2906994`	VC:07
QUINT4-UPS/24DC/24DC/10/EIP VC:07 Phoenix Contact / Hardware / QUINT4-UPS/24DC/24DC/10/EIP	`2907069`	VC:07
QUINT4-UPS/24DC/24DC/20/EIP VC:07 Phoenix Contact / Hardware / QUINT4-UPS/24DC/24DC/20/EIP	`2907074`	VC:07
QUINT4-UPS/24DC/24DC/40/EIP VC:07 Phoenix Contact / Hardware / QUINT4-UPS/24DC/24DC/40/EIP	`2907080`	VC:07

Known affected 4 products

Product	Identifier	Version
QUINT4-UPS/24DC/24DC/5/EIP VC:00<VC:07 Phoenix Contact / Hardware / QUINT4-UPS/24DC/24DC/5/EIP	`2906994`	VC:00<VC:07
QUINT4-UPS/24DC/24DC/10/EIP VC:00<VC:07 Phoenix Contact / Hardware / QUINT4-UPS/24DC/24DC/10/EIP	`2907069`	VC:00<VC:07
QUINT4-UPS/24DC/24DC/20/EIP VC:00<VC:07 Phoenix Contact / Hardware / QUINT4-UPS/24DC/24DC/20/EIP	`2907074`	VC:00<VC:07
QUINT4-UPS/24DC/24DC/40/EIP VC:00<VC:07 Phoenix Contact / Hardware / QUINT4-UPS/24DC/24DC/40/EIP	`2907080`	VC:00<VC:07

CVE-2025-41705

An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend.

6.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE-523 - Unprotected Transport of Credentials

Vendor Fix Starting with VC:07 the affected devices will be shipped with a fixed firmware.

Affected products

Fixed 4 products, the same list as for CVE-2025-41704

Known affected 4 products, the same list as for CVE-2025-41704

CVE-2025-41706

The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-length to trigger the issue without affecting the core functionality.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Vendor Fix Starting with VC:07 the affected devices will be shipped with a fixed firmware.

Affected products

Fixed 4 products, the same list as for CVE-2025-41704

Known affected 4 products, the same list as for CVE-2025-41704

CVE-2025-41707

The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the issue without affecting the core functionality.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Vendor Fix Starting with VC:07 the affected devices will be shipped with a fixed firmware.

Affected products

Fixed 4 products, the same list as for CVE-2025-41704

Known affected 4 products, the same list as for CVE-2025-41704

References

4 references

URL	Category
https://certvde.com/en/advisories/VDE-2025-072/	self
https://certvde.com/de/advisories/vendor/phoenixc…	external
https://phoenixcontact.com/psirt	external
https://phoenixcontact.csaf-tp.certvde.com/.well-…	self

Acknowledgments

CERTVDE certvde.com/en/

CyberDanube Security Research D. Blagojevic S. Dietz F. Koroknai T. Weber

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERTVDE",
        "summary": "Coordination",
        "urls": [
          "https://certvde.com/en/"
        ]
      },
      {
        "names": [
          "D. Blagojevic",
          "S. Dietz",
          "F. Koroknai",
          "T. Weber"
        ],
        "organization": "CyberDanube Security Research",
        "summary": "Reporting"
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale",
      "text": "High"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "Multiple vulnerabilities were discovered in the firmware of QUINT4-UPS EIP devices that can be used by an unauthenticated remote attacker to perform Denial of Service attacks and to gather login credentials for the Webfrontend.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "A successful attack can lead to Denial of Service or exposure of credentials.",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "Affected devices are designed and developed for the use in closed industrial networks. Phoenix Contact therefore strongly recommends using the devices exclusively in closed networks and protected by a suitable firewall.",
        "title": "Mitigation"
      },
      {
        "category": "description",
        "text": "Starting with version VC:07, all newly shipped devices will include firmware updates that address four vulnerabilities: CVE-2025-41704, CVE-2025-41705, CVE-2025-41706, and CVE-2025-41707.\n\nHowever, configuration of devices via unauthenticated Modbus/TCP remains possible in VC:07, as this protocol is a widely used standard in the industrial sector. As a result, VC:07 is still affected by CVE-2025-41703.",
        "title": "Remediation"
      },
      {
        "category": "description",
        "text": "Uninterruptible power supplies with an EIP interface.",
        "title": "Product description"
      },
      {
        "category": "general",
        "text": "For general information and recommendations on security measures to protect network-enabled devices, refer to the application note: [Application Note Security](https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf).",
        "title": "General Recommendation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@phoenixcontact.com",
      "name": "Phoenix Contact GmbH \u0026 Co. KG",
      "namespace": "https://phoenixcontact.com/psirt"
    },
    "references": [
      {
        "category": "self",
        "summary": "VDE-2025-072: Phoenix Contact: Security Advisory for QUINT4-UPS EIP - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2025-072/"
      },
      {
        "category": "external",
        "summary": "Phoenix Contact advisory overview at CERT@VDE",
        "url": "https://certvde.com/de/advisories/vendor/phoenixcontact/"
      },
      {
        "category": "external",
        "summary": "PCSA-2025-00013",
        "url": "https://phoenixcontact.com/psirt"
      },
      {
        "category": "self",
        "summary": "VDE-2025-072: Phoenix Contact: Security Advisory for QUINT4-UPS EIP - CSAF",
        "url": "https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-072.json"
      }
    ],
    "title": "Phoenix Contact: Security Advisory for QUINT4-UPS EIP",
    "tracking": {
      "aliases": [
        "VDE-2025-072",
        "PCSA-2025-00013"
      ],
      "current_release_date": "2025-10-14T06:00:00.000Z",
      "generator": {
        "date": "2025-10-02T10:44:33.155Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.36"
        }
      },
      "id": "VDE-2025-072",
      "initial_release_date": "2025-10-14T06:00:00.000Z",
      "revision_history": [
        {
          "date": "2025-10-14T06:00:00.000Z",
          "number": "1.0.0",
          "summary": "Initial revision."
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "VC:00\u003cVC:07",
                    "product": {
                      "name": "QUINT4-UPS/24DC/24DC/5/EIP VC:00\u003cVC:07",
                      "product_id": "CSAFPID-11001",
                      "product_identification_helper": {
                        "model_numbers": [
                          "2906994"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "VC:07",
                    "product": {
                      "name": "QUINT4-UPS/24DC/24DC/5/EIP VC:07",
                      "product_id": "CSAFPID-12001",
                      "product_identification_helper": {
                        "model_numbers": [
                          "2906994"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "QUINT4-UPS/24DC/24DC/5/EIP"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "VC:00\u003cVC:07",
                    "product": {
                      "name": "QUINT4-UPS/24DC/24DC/10/EIP VC:00\u003cVC:07",
                      "product_id": "CSAFPID-11002",
                      "product_identification_helper": {
                        "model_numbers": [
                          "2907069"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "VC:07",
                    "product": {
                      "name": "QUINT4-UPS/24DC/24DC/10/EIP VC:07",
                      "product_id": "CSAFPID-12002",
                      "product_identification_helper": {
                        "model_numbers": [
                          "2907069"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "QUINT4-UPS/24DC/24DC/10/EIP"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "VC:00\u003cVC:07",
                    "product": {
                      "name": "QUINT4-UPS/24DC/24DC/20/EIP VC:00\u003cVC:07",
                      "product_id": "CSAFPID-11003",
                      "product_identification_helper": {
                        "model_numbers": [
                          "2907074"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "VC:07",
                    "product": {
                      "name": "QUINT4-UPS/24DC/24DC/20/EIP VC:07",
                      "product_id": "CSAFPID-12003",
                      "product_identification_helper": {
                        "model_numbers": [
                          "2907074"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "QUINT4-UPS/24DC/24DC/20/EIP"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "VC:00\u003cVC:07",
                    "product": {
                      "name": "QUINT4-UPS/24DC/24DC/40/EIP VC:00\u003cVC:07",
                      "product_id": "CSAFPID-11004",
                      "product_identification_helper": {
                        "model_numbers": [
                          "2907080"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "VC:07",
                    "product": {
                      "name": "QUINT4-UPS/24DC/24DC/40/EIP VC:07",
                      "product_id": "CSAFPID-12004",
                      "product_identification_helper": {
                        "model_numbers": [
                          "2907080"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "QUINT4-UPS/24DC/24DC/40/EIP"
              }
            ],
            "category": "product_family",
            "name": "Hardware"
          }
        ],
        "category": "vendor",
        "name": "Phoenix Contact"
      }
    ],
    "product_groups": [
      {
        "group_id": "CSAFGID-0001",
        "product_ids": [
          "CSAFPID-11001",
          "CSAFPID-11002",
          "CSAFPID-11003",
          "CSAFPID-11004",
          "CSAFPID-12001",
          "CSAFPID-12002",
          "CSAFPID-12003",
          "CSAFPID-12004"
        ],
        "summary": "Affected Products."
      },
      {
        "group_id": "CSAFGID-0002",
        "product_ids": [
          "CSAFPID-12001",
          "CSAFPID-12002",
          "CSAFPID-12003",
          "CSAFPID-12004"
        ],
        "summary": "Fixed Products. (CVE-2025-41704, CVE-2025-41705, CVE-2025-41706, CVE-2025-41707)"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-41703",
      "cwe": {
        "id": "CWE-306",
        "name": "Missing Authentication for Critical Function"
      },
      "notes": [
        {
          "category": "description",
          "text": "An unauthenticated remote attacker can cause a Denial of Service by turning off the output of the UPS via Modbus command.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-11001",
          "CSAFPID-11002",
          "CSAFPID-11003",
          "CSAFPID-11004",
          "CSAFPID-12001",
          "CSAFPID-12002",
          "CSAFPID-12003",
          "CSAFPID-12004"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "This product was designed for use in closed industrial networks. Phoenix Contact strongly recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our [application note](https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf). \n\nIn the industrial sector it is common practice to use Modbus/TCP without authentication.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "Configuration via unauthenticated modbus commands is a commonly used feature in the industrial sector. It is necessary take appropriate steps in the application to limit modbus access to the device. ",
          "product_ids": [
            "CSAFPID-11001",
            "CSAFPID-11002",
            "CSAFPID-11003",
            "CSAFPID-11004",
            "CSAFPID-12001",
            "CSAFPID-12002",
            "CSAFPID-12003",
            "CSAFPID-12004"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-11001",
            "CSAFPID-11002",
            "CSAFPID-11003",
            "CSAFPID-11004",
            "CSAFPID-12001",
            "CSAFPID-12002",
            "CSAFPID-12003",
            "CSAFPID-12004"
          ]
        }
      ],
      "title": "Phoenix Contact: UPS Shutdown via Unauthenticated Modbus Command"
    },
    {
      "cve": "CVE-2025-41704",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "description",
          "text": "An unauthanticated remote attacker can perform a DoS of the Modbus service by sending a specific function  and sub-function code without affecting the core functionality.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-12001",
          "CSAFPID-12002",
          "CSAFPID-12003",
          "CSAFPID-12004"
        ],
        "known_affected": [
          "CSAFPID-11001",
          "CSAFPID-11002",
          "CSAFPID-11003",
          "CSAFPID-11004"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "This product was designed for use in closed industrial networks. Phoenix Contact strongly recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our [application note](https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf). ",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Starting with VC:07 the affected devices will be shipped with a fixed firmware. ",
          "group_ids": [
            "CSAFGID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 5.3,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 5.3,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-11001",
            "CSAFPID-11002",
            "CSAFPID-11003",
            "CSAFPID-11004"
          ]
        }
      ],
      "title": "Phoenix Contact: Unauthenticated Modbus Service DoS via Crafted Function Code"
    },
    {
      "cve": "CVE-2025-41705",
      "cwe": {
        "id": "CWE-523",
        "name": "Unprotected Transport of Credentials"
      },
      "notes": [
        {
          "category": "description",
          "text": "An unauthenticated remote\nattacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-12001",
          "CSAFPID-12002",
          "CSAFPID-12003",
          "CSAFPID-12004"
        ],
        "known_affected": [
          "CSAFPID-11001",
          "CSAFPID-11002",
          "CSAFPID-11003",
          "CSAFPID-11004"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "This product was designed for use in closed industrial networks. Phoenix Contact strongly recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our [application note](https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf). ",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Starting with VC:07 the affected devices will be shipped with a fixed firmware. ",
          "group_ids": [
            "CSAFGID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 6.8,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 6.8,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-11001",
            "CSAFPID-11002",
            "CSAFPID-11003",
            "CSAFPID-11004"
          ]
        }
      ],
      "title": "Phoenix Contact: WebSocket Message Interception Leaks Webfrontend Credentials"
    },
    {
      "cve": "CVE-2025-41706",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "notes": [
        {
          "category": "description",
          "text": "The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-length to trigger the issue without affecting the core functionality.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-12001",
          "CSAFPID-12002",
          "CSAFPID-12003",
          "CSAFPID-12004"
        ],
        "known_affected": [
          "CSAFPID-11001",
          "CSAFPID-11002",
          "CSAFPID-11003",
          "CSAFPID-11004"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "This product was designed for use in closed industrial networks. Phoenix Contact strongly recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our [application note](https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf). \n",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Starting with VC:07 the affected devices will be shipped with a fixed firmware. ",
          "group_ids": [
            "CSAFGID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 5.3,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 5.3,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-11001",
            "CSAFPID-11002",
            "CSAFPID-11003",
            "CSAFPID-11004"
          ]
        }
      ],
      "title": "Phoenix Contact: Webserver Denial of Service through Malformed Content-Length"
    },
    {
      "cve": "CVE-2025-41707",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "notes": [
        {
          "category": "description",
          "text": "The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the issue without affecting the core functionality.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-12001",
          "CSAFPID-12002",
          "CSAFPID-12003",
          "CSAFPID-12004"
        ],
        "known_affected": [
          "CSAFPID-11001",
          "CSAFPID-11002",
          "CSAFPID-11003",
          "CSAFPID-11004"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "This product was designed for use in closed industrial networks. Phoenix Contact strongly recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our [application note](https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf). \n",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Starting with VC:07 the affected devices will be shipped with a fixed firmware. ",
          "group_ids": [
            "CSAFGID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 5.3,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 5.3,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-11001",
            "CSAFPID-11002",
            "CSAFPID-11003",
            "CSAFPID-11004"
          ]
        }
      ],
      "title": "Phoenix Contact: WebSocket Handler Denial of Service"
    }
  ]
}

CVE-2025-41703 (GCVE-0-2025-41703)

Vulnerability from cvelistv5 – Published: 2025-10-14 08:05 – Updated: 2025-11-03 17:44

Title

Phoenix Contact: UPS Shutdown via Unauthenticated Modbus Command

Summary

An unauthenticated remote attacker can cause a Denial of Service by turning off the output of the UPS via Modbus command.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-10-14 18:38 UTC

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

CERTVDE icscert root

References

2 references

URL	Tags
https://certvde.com/de/advisories/VDE-2025-072
http://seclists.org/fulldisclosure/2025/Oct/12

Impacted products

4 products

Vendor	Product	Version
Phoenix Contact	QUINT4-UPS/24DC/24DC/5/EIP	Affected: VC:00 , ≤ VC:07 (semver)
Phoenix Contact	QUINT4-UPS/24DC/24DC/10/EIP	Affected: VC:00 , ≤ VC:07 (semver)
Phoenix Contact	QUINT4-UPS/24DC/24DC/20/EIP	Affected: VC:00 , ≤ VC:07 (semver)
Phoenix Contact	QUINT4-UPS/24DC/24DC/40/EIP	Affected: VC:00 , ≤ VC:07 (semver)

Credits

D. Blagojevic, S. Dietz, F. Koroknai, T. Weber from CyberDanube Security Research

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-41703",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-14T18:38:31.786647Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-14T18:38:47.646Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:44:45.524Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2025/Oct/12"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "QUINT4-UPS/24DC/24DC/5/EIP",
          "vendor": "Phoenix Contact",
          "versions": [
            {
              "lessThanOrEqual": "VC:07",
              "status": "affected",
              "version": "VC:00",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QUINT4-UPS/24DC/24DC/10/EIP",
          "vendor": "Phoenix Contact",
          "versions": [
            {
              "lessThanOrEqual": "VC:07",
              "status": "affected",
              "version": "VC:00",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QUINT4-UPS/24DC/24DC/20/EIP",
          "vendor": "Phoenix Contact",
          "versions": [
            {
              "lessThanOrEqual": "VC:07",
              "status": "affected",
              "version": "VC:00",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QUINT4-UPS/24DC/24DC/40/EIP",
          "vendor": "Phoenix Contact",
          "versions": [
            {
              "lessThanOrEqual": "VC:07",
              "status": "affected",
              "version": "VC:00",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "D. Blagojevic, S. Dietz, F. Koroknai, T. Weber from CyberDanube Security Research"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An unauthenticated remote attacker can cause a Denial of Service by turning off the output of the UPS via Modbus command.\u003cbr\u003e"
            }
          ],
          "value": "An unauthenticated remote attacker can cause a Denial of Service by turning off the output of the UPS via Modbus command."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306 Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-14T08:05:23.395Z",
        "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
        "shortName": "CERTVDE"
      },
      "references": [
        {
          "url": "https://certvde.com/de/advisories/VDE-2025-072"
        }
      ],
      "source": {
        "advisory": "VDE-2025-072",
        "defect": [
          "CERT@VDE#641835"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Phoenix Contact: UPS Shutdown via Unauthenticated Modbus Command",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
    "assignerShortName": "CERTVDE",
    "cveId": "CVE-2025-41703",
    "datePublished": "2025-10-14T08:05:23.395Z",
    "dateReserved": "2025-04-16T11:17:48.310Z",
    "dateUpdated": "2025-11-03T17:44:45.524Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-41704 (GCVE-0-2025-41704)

Vulnerability from cvelistv5 – Published: 2025-10-14 08:05 – Updated: 2025-11-03 17:44

Title

Phoenix Contact: Unauthenticated Modbus Service DoS via Crafted Function Code

Summary

An unauthanticated remote attacker can perform a DoS of the Modbus service by sending a specific function and sub-function code without affecting the core functionality.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-10-14 18:39 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

CERTVDE icscert root

References

2 references

URL	Tags
https://certvde.com/de/advisories/VDE-2025-072
http://seclists.org/fulldisclosure/2025/Oct/12

Impacted products

4 products

Vendor	Product	Version
Phoenix Contact	QUINT4-UPS/24DC/24DC/5/EIP	Affected: VC:00 , < VC:07 (semver)
Phoenix Contact	QUINT4-UPS/24DC/24DC/10/EIP	Affected: VC:00 , < VC:07 (semver)
Phoenix Contact	QUINT4-UPS/24DC/24DC/20/EIP	Affected: VC:00 , < VC:07 (semver)
Phoenix Contact	QUINT4-UPS/24DC/24DC/40/EIP	Affected: VC:00 , < VC:07 (semver)

Credits

D. Blagojevic, S. Dietz, F. Koroknai, T. Weber from CyberDanube Security Research

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-41704",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-14T18:39:04.874992Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-14T18:39:22.997Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:44:46.483Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2025/Oct/12"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "QUINT4-UPS/24DC/24DC/5/EIP",
          "vendor": "Phoenix Contact",
          "versions": [
            {
              "lessThan": "VC:07",
              "status": "affected",
              "version": "VC:00",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QUINT4-UPS/24DC/24DC/10/EIP",
          "vendor": "Phoenix Contact",
          "versions": [
            {
              "lessThan": "VC:07",
              "status": "affected",
              "version": "VC:00",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QUINT4-UPS/24DC/24DC/20/EIP",
          "vendor": "Phoenix Contact",
          "versions": [
            {
              "lessThan": "VC:07",
              "status": "affected",
              "version": "VC:00",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QUINT4-UPS/24DC/24DC/40/EIP",
          "vendor": "Phoenix Contact",
          "versions": [
            {
              "lessThan": "VC:07",
              "status": "affected",
              "version": "VC:00",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "D. Blagojevic, S. Dietz, F. Koroknai, T. Weber from CyberDanube Security Research"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An unauthanticated remote attacker can perform a DoS of the Modbus service by sending a specific function and sub-function code without affecting the core functionality.\u003cbr\u003e"
            }
          ],
          "value": "An unauthanticated remote attacker can perform a DoS of the Modbus service by sending a specific function and sub-function code without affecting the core functionality."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-14T08:05:34.171Z",
        "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
        "shortName": "CERTVDE"
      },
      "references": [
        {
          "url": "https://certvde.com/de/advisories/VDE-2025-072"
        }
      ],
      "source": {
        "advisory": "VDE-2025-072",
        "defect": [
          "CERT@VDE#641835"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Phoenix Contact: Unauthenticated Modbus Service DoS via Crafted Function Code",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
    "assignerShortName": "CERTVDE",
    "cveId": "CVE-2025-41704",
    "datePublished": "2025-10-14T08:05:34.171Z",
    "dateReserved": "2025-04-16T11:17:48.310Z",
    "dateUpdated": "2025-11-03T17:44:46.483Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-41705 (GCVE-0-2025-41705)

Vulnerability from cvelistv5 – Published: 2025-10-14 08:05 – Updated: 2025-11-03 17:44

Title

Phoenix Contact: WebSocket Message Interception Leaks Webfrontend Credentials

Summary

An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-10-14 18:39 UTC

CWE

CWE-523 - Unprotected Transport of Credentials

Assigner

CERTVDE icscert root

References

2 references

URL	Tags
https://certvde.com/de/advisories/VDE-2025-072
http://seclists.org/fulldisclosure/2025/Oct/12

Impacted products

4 products

Vendor	Product	Version
Phoenix Contact	QUINT4-UPS/24DC/24DC/5/EIP	Affected: VC:00 , < VC:07 (semver)
Phoenix Contact	QUINT4-UPS/24DC/24DC/10/EIP	Affected: VC:00 , < VC:07 (semver)
Phoenix Contact	QUINT4-UPS/24DC/24DC/20/EIP	Affected: VC:00 , < VC:07 (semver)
Phoenix Contact	QUINT4-UPS/24DC/24DC/40/EIP	Affected: VC:00 , < VC:07 (semver)

Credits

D. Blagojevic, S. Dietz, F. Koroknai, T. Weber from CyberDanube Security Research

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-41705",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-14T18:39:39.309928Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-14T18:39:54.898Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:44:47.442Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2025/Oct/12"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "QUINT4-UPS/24DC/24DC/5/EIP",
          "vendor": "Phoenix Contact",
          "versions": [
            {
              "lessThan": "VC:07",
              "status": "affected",
              "version": "VC:00",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QUINT4-UPS/24DC/24DC/10/EIP",
          "vendor": "Phoenix Contact",
          "versions": [
            {
              "lessThan": "VC:07",
              "status": "affected",
              "version": "VC:00",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QUINT4-UPS/24DC/24DC/20/EIP",
          "vendor": "Phoenix Contact",
          "versions": [
            {
              "lessThan": "VC:07",
              "status": "affected",
              "version": "VC:00",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QUINT4-UPS/24DC/24DC/40/EIP",
          "vendor": "Phoenix Contact",
          "versions": [
            {
              "lessThan": "VC:07",
              "status": "affected",
              "version": "VC:00",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "D. Blagojevic, S. Dietz, F. Koroknai, T. Weber from CyberDanube Security Research"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend.\u003cbr\u003e"
            }
          ],
          "value": "An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-523",
              "description": "CWE-523 Unprotected Transport of Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-14T08:06:21.805Z",
        "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
        "shortName": "CERTVDE"
      },
      "references": [
        {
          "url": "https://certvde.com/de/advisories/VDE-2025-072"
        }
      ],
      "source": {
        "advisory": "VDE-2025-072",
        "defect": [
          "CERT@VDE#641835"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Phoenix Contact: WebSocket Message Interception Leaks Webfrontend Credentials",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
    "assignerShortName": "CERTVDE",
    "cveId": "CVE-2025-41705",
    "datePublished": "2025-10-14T08:05:43.031Z",
    "dateReserved": "2025-04-16T11:17:48.310Z",
    "dateUpdated": "2025-11-03T17:44:47.442Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-41706 (GCVE-0-2025-41706)

Vulnerability from cvelistv5 – Published: 2025-10-14 08:05 – Updated: 2025-11-03 17:44

Title

Phoenix Contact: Webserver Denial of Service through Malformed Content-Length

Summary

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-10-14 18:40 UTC

CWE

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Assigner

CERTVDE icscert root

References

2 references

URL	Tags
https://certvde.com/de/advisories/VDE-2025-072
http://seclists.org/fulldisclosure/2025/Oct/12

Impacted products

4 products

Vendor	Product	Version
Phoenix Contact	QUINT4-UPS/24DC/24DC/5/EIP	Affected: VC:00 , < VC:07 (semver)
Phoenix Contact	QUINT4-UPS/24DC/24DC/10/EIP	Affected: VC:00 , < VC:07 (semver)
Phoenix Contact	QUINT4-UPS/24DC/24DC/20/EIP	Affected: VC:00 , < VC:07 (semver)
Phoenix Contact	QUINT4-UPS/24DC/24DC/40/EIP	Affected: VC:00 , < VC:07 (semver)

Credits

D. Blagojevic, S. Dietz, F. Koroknai, T. Weber from CyberDanube Security Research

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-41706",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-14T18:40:44.318321Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-14T18:40:56.043Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:44:48.379Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2025/Oct/12"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "QUINT4-UPS/24DC/24DC/5/EIP",
          "vendor": "Phoenix Contact",
          "versions": [
            {
              "lessThan": "VC:07",
              "status": "affected",
              "version": "VC:00",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QUINT4-UPS/24DC/24DC/10/EIP",
          "vendor": "Phoenix Contact",
          "versions": [
            {
              "lessThan": "VC:07",
              "status": "affected",
              "version": "VC:00",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QUINT4-UPS/24DC/24DC/20/EIP",
          "vendor": "Phoenix Contact",
          "versions": [
            {
              "lessThan": "VC:07",
              "status": "affected",
              "version": "VC:00",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QUINT4-UPS/24DC/24DC/40/EIP",
          "vendor": "Phoenix Contact",
          "versions": [
            {
              "lessThan": "VC:07",
              "status": "affected",
              "version": "VC:00",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "D. Blagojevic, S. Dietz, F. Koroknai, T. Weber from CyberDanube Security Research"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-length to trigger the issue without affecting the core functionality.\u003cbr\u003e"
            }
          ],
          "value": "The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-length to trigger the issue without affecting the core functionality."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-120",
              "description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-14T08:05:56.266Z",
        "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
        "shortName": "CERTVDE"
      },
      "references": [
        {
          "url": "https://certvde.com/de/advisories/VDE-2025-072"
        }
      ],
      "source": {
        "advisory": "VDE-2025-072",
        "defect": [
          "CERT@VDE#641835"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Phoenix Contact: Webserver Denial of Service through Malformed Content-Length",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
    "assignerShortName": "CERTVDE",
    "cveId": "CVE-2025-41706",
    "datePublished": "2025-10-14T08:05:56.266Z",
    "dateReserved": "2025-04-16T11:17:48.310Z",
    "dateUpdated": "2025-11-03T17:44:48.379Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-41707 (GCVE-0-2025-41707)

Vulnerability from cvelistv5 – Published: 2025-10-14 08:06 – Updated: 2025-11-03 17:44

Title

Phoenix Contact: WebSocket Handler Denial of Service

Summary

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-10-14 18:41 UTC

CWE

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Assigner

CERTVDE icscert root

References

2 references

URL	Tags
https://certvde.com/de/advisories/VDE-2025-072
http://seclists.org/fulldisclosure/2025/Oct/12

Impacted products

4 products

Vendor	Product	Version
Phoenix Contact	QUINT4-UPS/24DC/24DC/5/EIP	Affected: VC:00 , < VC:07 (semver)
Phoenix Contact	QUINT4-UPS/24DC/24DC/10/EIP	Affected: VC:00 , < VC:07 (semver)
Phoenix Contact	QUINT4-UPS/24DC/24DC/20/EIP	Affected: VC:00 , < VC:07 (semver)
Phoenix Contact	QUINT4-UPS/24DC/24DC/40/EIP	Affected: VC:00 , < VC:07 (semver)

Credits

D. Blagojevic, S. Dietz, F. Koroknai, T. Weber from CyberDanube Security Research

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-41707",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-14T18:41:16.009240Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-14T18:41:30.126Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:44:49.327Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2025/Oct/12"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "QUINT4-UPS/24DC/24DC/5/EIP",
          "vendor": "Phoenix Contact",
          "versions": [
            {
              "lessThan": "VC:07",
              "status": "affected",
              "version": "VC:00",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QUINT4-UPS/24DC/24DC/10/EIP",
          "vendor": "Phoenix Contact",
          "versions": [
            {
              "lessThan": "VC:07",
              "status": "affected",
              "version": "VC:00",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QUINT4-UPS/24DC/24DC/20/EIP",
          "vendor": "Phoenix Contact",
          "versions": [
            {
              "lessThan": "VC:07",
              "status": "affected",
              "version": "VC:00",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QUINT4-UPS/24DC/24DC/40/EIP",
          "vendor": "Phoenix Contact",
          "versions": [
            {
              "lessThan": "VC:07",
              "status": "affected",
              "version": "VC:00",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "D. Blagojevic, S. Dietz, F. Koroknai, T. Weber from CyberDanube Security Research"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the issue without affecting the core functionality.\u003cbr\u003e"
            }
          ],
          "value": "The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the issue without affecting the core functionality."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-120",
              "description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-14T08:06:11.424Z",
        "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
        "shortName": "CERTVDE"
      },
      "references": [
        {
          "url": "https://certvde.com/de/advisories/VDE-2025-072"
        }
      ],
      "source": {
        "advisory": "VDE-2025-072",
        "defect": [
          "CERT@VDE#641835"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Phoenix Contact: WebSocket Handler Denial of Service",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
    "assignerShortName": "CERTVDE",
    "cveId": "CVE-2025-41707",
    "datePublished": "2025-10-14T08:06:11.424Z",
    "dateReserved": "2025-04-16T11:17:48.311Z",
    "dateUpdated": "2025-11-03T17:44:49.327Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

VDE-2025-072

CVE-2025-41703 (GCVE-0-2025-41703)

CVE-2025-41704 (GCVE-0-2025-41704)

CVE-2025-41705 (GCVE-0-2025-41705)

CVE-2025-41706 (GCVE-0-2025-41706)

CVE-2025-41707 (GCVE-0-2025-41707)

Tags

Sightings

Nomenclature

Related by attack behaviour