MAL-2025-31414 Malicious code in quiver-5cpgy-htdke-phoenix-project (npm)

The package quiver-5cpgy-htdke-phoenix-project was found to contain malicious code...

MAL-2025-28354 Malicious code in ophiuchus-phoenix-rimraf-convict (npm)

The package ophiuchus-phoenix-rimraf-convict was found to contain malicious code...

MAL-2025-29146 Malicious code in phoenix-fermion-markdownlint-holography (npm)

The package phoenix-fermion-markdownlint-holography was found to contain malicious code...

MAL-2025-38430 Malicious code in violet-r6v0j-jw2g3-phoenix-project (npm)

The package violet-r6v0j-jw2g3-phoenix-project was found to contain malicious code...

PHOENIX CONTACT DaUM 访问控制错误漏洞

Phoenix Contact DaUM is a device management software from Phoenix Contact, Germany. An access control error vulnerability exists in PHOENIX CONTACT DaUM that stems from improper permissions on nssm.exe, which could lead to elevated privileges...

PT-2025-32635 · Nssm.Exe · Nssm.Exe

Name of the Vulnerable Software and Affected Versions: nssm.exe affected versions not specified Description: A local attacker with limited privileges can exploit improper permissions on nssm.exe to escalate privileges and gain administrative access. Recommendations: At the moment, there is no...

PHOENIX CONTACT多款产品 安全漏洞

PHOENIX CONTACT AXL F BK PN etc. are products of PHOENIX CONTACT, Germany.PHOENIX CONTACT AXL F BK PN is a bus coupler.PHOENIX CONTACT AXL F BK PN TPS etc. are products of PHOENIX CONTACT, Germany.PHOENIX CONTACT AXL F BK PN TPS is a bus coupler. Phoenix Contact AXL F BK PN TPS is a Bus Coupler...

(Pwn2Own) Phoenix Contact CHARX SEC-3150 OCPP Authentication Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Phoenix Contact CHARX SEC-3150 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the OCPP service. The issue result...

(Pwn2Own) Phoenix Contact CHARX SEC-3150 Origin Validation Error Firewall Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass firewall rules and access another interface on affected installations of Phoenix Contact CHARX SEC-3150 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of firewa...

(Pwn2Own) Phoenix Contact CHARX SEC-3100 Command Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Phoenix Contact CHARX SEC-3100 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the defaultroutemetric parameter to the...

(Pwn2Own) Phoenix Contact CHARX SEC-3150 Configuration Service Missing Authentication Vulnerability

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Phoenix Contact CHARX SEC-3150 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration service, which listens on TCP port 500...

CVE-2025-41668 Phoenix Contact: File access due to the replacement of a critical file used by the service security-profile

A low privileged remote attacker with file access can replace a critical file or folder used by the service security-profile to get read, write and execute access to any file on the device...

CVE-2025-41667 Phoenix Contact: File access due to the replacement of a critical file used by the arp-preinit script

A low privileged remote attacker with file access can replace a critical file used by the arp-preinit script to get read, write and execute access to any file on the device...

CVE-2025-41666 Phoenix Contact: File access due to the replacement of a critical file used by the watchdog

A low privileged remote attacker with file access can replace a critical file used by the watchdog to get read, write and execute access to any file on the device after the watchdog has been initialized...

CVE-2025-41665 Phoenix Contact: DoS of the PLC due to incorrect default permissions possible

An low privileged remote attacker can enforce the watchdog of the affected devices to reboot the PLC due to incorrect default permissions of a config file...

CVE-2025-41665 Phoenix Contact: DoS of the PLC due to incorrect default permissions possible

An low privileged remote attacker can enforce the watchdog of the affected devices to reboot the PLC due to incorrect default permissions of a config file...

CVE-2025-41665

CVE-2025-41665 affects Phoenix Contact PLCs (e.g., AXC F 1152 and related controllers) due to incorrect default permissions on a configuration file. A low-privileged remote attacker can force the watchdog to reboot the PLC, causing a denial of service. The vulnerability is documented with a CVSS ...

PHOENIX CONTACT多款产品 安全漏洞

PHOENIX CONTACT AXC F 1152 and others are a controller device from PHOENIX CONTACT, Germany. A security vulnerability exists in various PHOENIX CONTACT products, which stems from incorrect default permissions in the configuration file, which could lead to a low-privilege attacker forcing the...

PHOENIX CONTACT CHARX SEC-3xxx 访问控制错误漏洞

PHOENIX CONTACT CHARX SEC-3000 etc. are products of PHOENIX CONTACT, Germany.PHOENIX CONTACT CHARX SEC-3000 is an AC Charge Controller.PHOENIX CONTACT CHARX SEC-3050 is an AC Charge Controller.PHOENIX CONTACT CHARX SEC-3100 is an AC Charge Controller. PHOENIX CONTACT CHARX SEC-3100 is an AC charg...

PHOENIX CONTACT多款产品 后置链接漏洞

PHOENIX CONTACT AXC F 1152 and others are a controller device from PHOENIX CONTACT, Germany. A backlink vulnerability exists in various PHOENIX CONTACT products, which stems from the fact that key files used by the watchdog can be replaced, potentially allowing a low-privileged attacker to gain...