High severity · published Aug 12, 2026
CVE-2025-41770
Unauthenticated Denial of Service
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an remote attacker to interrupt access via the client application. Successful exploitation prevents communication until the PLCnext service is manually restarted.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
AXC F 1152 · Phoenix Contact
2019.0.4 before 2026.0.3 · source: vendor
AF
AXC F 1252 · Phoenix Contact
2019.0.4 before 2026.0.3 · source: vendor
AF
AXC F 2000 EA · Phoenix Contact
2019.0.4 before 2026.0.3 · source: vendor
AF
AXC F 2152 · Phoenix Contact
2019.0.4 before 2026.0.3 · source: vendor
AF
AXC F 3152 · Phoenix Contact
2019.0.4 before 2026.0.3 · source: vendor
B9
BPC 9102S · Phoenix Contact
2019.0.4 before 2026.0.3 · source: vendor
B9
BPC 9202S · Phoenix Contact
2019.0.4 before 2026.0.3 · source: vendor
CC
Catan C1 · Phoenix Contact
2019.0.4 before 2026.0.3 · source: vendor
E1
EPC 1502 · Phoenix Contact
2019.0.4 before 2026.0.3 · source: vendor
E1
EPC 1522 · Phoenix Contact
2019.0.4 before 2026.0.3 · source: vendor
R4
RFC 4072R · Phoenix Contact
2019.0.4 before 2026.0.3 · source: vendor
R4
RFC 4072S · Phoenix Contact
2019.0.4 before 2026.0.3 · source: vendor
Affected product
AF
AXC F 1152
Phoenix Contact
More from AXC F 1152
9.8
CVE-2025-41769
Unauthenticated Buffer Overflow in PROFINET Service
8.8
CVE-2025-41669
Insufficient Verification of Data Authenticity
7.8
CVE-2025-41670
Untrusted Search Path
4.3
CVE-2025-41771
SQL injection