CVE-2025-41717: falha de alta gravidade em Phoenix Contact CLOUD CLIENT 1101T-TX/TX
Config-Upload Code Injection
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.8epss 0.6%
An unauthenticated remote attacker can trick a high privileged user into uploading a malicious payload via the config-upload endpoint, leading to code injection as root. This results in a total loss of confidentiality, availability and integrity due to improper control of code generation ('Code Injection’).
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
Phoenix Contact · CLOUD CLIENT 1101T-TX/TXPhoenix Contact · TC CLOUD CLIENT 1002-4G ATTPhoenix Contact · TC CLOUD CLIENT 1002-TX/TXPhoenix Contact · TC ROUTER 2002T-3GPhoenix Contact · TC ROUTER 2002T-4GPhoenix Contact · TC ROUTER 3002T-3GPhoenix Contact · TC ROUTER 3002T-4GPhoenix Contact · TC ROUTER 3002T-4G ATTPhoenix Contact · TC ROUTER 3002T-4G GLPhoenix Contact · TC ROUTER 3002T-4G VZWPhoenix Contact · TC ROUTER 5004T-5G EU