Summary
Phoenix Contact addressed three vulnerabilities in PLCnext firmware, including a critical buffer overflow (CVE-2025-41769) that allows unauthenticated remote code execution. The update also fixes denial-of-service and SQL injection flaws affecting various industrial controllers.
Take Action:
If you run Phoenix Contact PLCnext controllers, first make sure these devices are isolated from the internet and reachable only from trusted networks. Then update the firmware to version 2026.0.3 on every compatible device. For the obsolete EPC 1502 and EPC 1522, which will never be patched, take them off the network or replace them with supported hardware.
Read the full article on BeyondMachines
This article was originally published on BeyondMachines
