Total 143 security vulnerabilities recorded for phoenixcontact software and firmware.
A low privileged remote attacker can gain the root password due to improper removal of sensitive information before storage or transfer....
An XSS vulnerability in pxc_portSfp.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided...
An XSS vulnerability in pxc_portCntr.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provide...
An XSS vulnerability in pxc_PortCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided...
An XSS vulnerability in port_util.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided b...
An XSS vulnerability in pxc_Dot1xCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provide...
An XSS vulnerability in pxc_vlanIntfCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POS...
An XSS vulnerability in pxc_portSecCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST...
An XSS vulnerability in pxc_portCntr2.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST ...
An attacker can use an undocumented UART port on the PCB as a side-channel to get root access e.g. with the credentials obtained from CVE-2025-4169...
An attacker can use an undocumented UART port on the PCB as a side-channel with the user hardcoded credentials obtained from CVE-2025-41692 to gain re...
An XSS vulnerability in dyn_conn.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST reque...
A low privileged remote attacker can run the webshell with an empty command containing whitespace. The server will then block until it receives more d...
A low privileged remote attacker can use the ssh feature to execute commands directly after login. The process stays open and uses resources which lea...
A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a we...
An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface....
An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations....
An unauthenticated local attacker can inject a command that is subsequently executed as root, leading to a privilege escalation....
An unauthenticated adjacent attacker can modify configuration by sending specific requests to an API-endpoint resulting in read and write access due t...
A low privileged local attacker can leverage insecure permissions via SSH on the affected devices to escalate privileges to root....
A local attacker with a local user account can leverage a vulnerable script via SSH to escalate privileges to root due to improper input validation....
A physical attacker with access to the device display via USB-C can send a message to the device which triggers an unsecure copy to a buffer resulting...
An unauthenticated remote attacker can use MQTT messages to trigger out-of-bounds writes in charging stations complying with German Calibration Law, r...
An unauthenticated remote attacker can use MQTT messages to crash a service on charging stations complying with German Calibration Law, resulting in a...