Vulnerabilidades em Phoenix Contact

190 resultados
Análise Vexday

Com 74 CVEs catalogadas e nenhuma entrada confirmada no catálogo CISA KEV, os produtos Phoenix Contact apresentam taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão imediata por parte de agentes maliciosos. No entanto, chama atenção o EPSS de 0,8113 associado à CVE-2014-9195, indicando alta probabilidade estatística de exploração e justificando priorização mesmo na ausência de registro formal no KEV. A falha mais recorrente é do tipo CWE-79 (Cross-Site Scripting), com 4 CVEs acompanhadas de prova de conceito pública, o que reduz a barreira técnica para tentativas de exploração. As 3 vulnerabilidades surgidas nos últimos 90 dias reforçam a necessidade de monitoramento contínuo do portfólio, especialmente nos 2 registros de severidade crítica.

CVE-2026-27549HIGHCommand Injection in /index.php/attached_devices_tab/do_uploadEPSS 2.1%CVE-2026-27547HIGHCommand Injection in /index.php/ajax/get_iodd_menu_infoEPSS 2.1%CVE-2026-27550HIGHCommand Injection in Field_Shadow_Password ClassEPSS 2.1%CVE-2020-12498HIGHPhoenix Contact Automation Worx <= 1.87: out-of-bounds read remote code executionEPSS 2.1%CVE-2026-27563HIGHCommand Injection via GET in /api/datastorage/dataEPSS 2.0%CVE-2026-27564HIGHCommand Injection via PUT in /api/datastorage/dataEPSS 2.0%CVE-2023-3526CRITICALPHOENIX CONTACT: Cross-site Scripting vulnerability in TC ROUTER, TC CLOUD CLIENT and CLOUD CLIENT devicesEPSS 1.8%CVE-2021-33542HIGHPhoenix Contact: Automation Worx Software Suite affected by Remote Code Execution (RCE) vulnerabilityEPSS 1.8%CVE-2025-41706MEDIUMPhoenix Contact: Webserver Denial of Service through Malformed Content-LengthEPSS 1.7%CVE-2025-41704MEDIUMPhoenix Contact: Unauthenticated Modbus Service DoS via Crafted Function CodeEPSS 1.6%CVE-2022-31800CRITICALInsufficient Verification of Data Vulnerability in PHOENIX CONTACT classic line industrial controllersEPSS 1.6%CVE-2021-33541HIGHPhoenix Contact: ILC1x Industrial controllers affected by Denial-of-Service vulnerabilityEPSS 1.5%CVE-2024-25998HIGHPHOENIX CONTACT: Command injection in the OCPP ServiceEPSS 1.5%CVE-2025-41707MEDIUMPhoenix Contact: WebSocket Handler Denial of ServiceEPSS 1.4%CVE-2023-3569MEDIUMPHOENIX CONTACT: Denial-of-Service due to malicious XML files in TC ROUTER, TC CLOUD CLIENT and CLOUD CLIENTEPSS 1.4%CVE-2024-25995CRITICALPHOENIX CONTACT: Remote code execution in CHARX SeriesEPSS 1.4%CVE-2026-44098HIGHOS Command Injection in OCPP Agent via charge_box_idEPSS 1.4%CVE-2022-29897CRITICALRemote Code Execution in all versions of various RAD-ISM-900-EN-* devices by PHOENIX CONTACTEPSS 1.3%CVE-2024-28135MEDIUMPHOENIX CONTACT: command injection vulnerability in the API of the CHARX SeriesEPSS 1.3%CVE-2023-3573HIGHPHOENIX CONTACT: Command Injection in WP 6xxx Web panelsEPSS 1.2%