Search
Find a vulnerability
Search criteria
10 vulnerabilities found for QUINT4-UPS/24DC/24DC/20/EIP by Phoenix Contact
CVE-2025-41707 (GCVE-0-2025-41707)
Vulnerability from nvd – Published: 2025-10-14 08:06 – Updated: 2025-11-03 17:44
VLAI
EPSS
VEX
Title
Phoenix Contact: WebSocket Handler Denial of Service
Summary
The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the issue without affecting the core functionality.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
2 references
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/5/EIP |
Affected:
VC:00 , < VC:07
(semver)
|
|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/10/EIP |
Affected:
VC:00 , < VC:07
(semver)
|
|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/20/EIP |
Affected:
VC:00 , < VC:07
(semver)
|
|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/40/EIP |
Affected:
VC:00 , < VC:07
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-41707",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-14T18:41:16.009240Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-14T18:41:30.126Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T17:44:49.327Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2025/Oct/12"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/5/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/10/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/20/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/40/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "D. Blagojevic, S. Dietz, F. Koroknai, T. Weber from CyberDanube Security Research"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the issue without affecting the core functionality.\u003cbr\u003e"
}
],
"value": "The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the issue without affecting the core functionality."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-14T08:06:11.424Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://certvde.com/de/advisories/VDE-2025-072"
}
],
"source": {
"advisory": "VDE-2025-072",
"defect": [
"CERT@VDE#641835"
],
"discovery": "UNKNOWN"
},
"title": "Phoenix Contact: WebSocket Handler Denial of Service",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2025-41707",
"datePublished": "2025-10-14T08:06:11.424Z",
"dateReserved": "2025-04-16T11:17:48.311Z",
"dateUpdated": "2025-11-03T17:44:49.327Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-41706 (GCVE-0-2025-41706)
Vulnerability from nvd – Published: 2025-10-14 08:05 – Updated: 2025-11-03 17:44
VLAI
EPSS
VEX
Title
Phoenix Contact: Webserver Denial of Service through Malformed Content-Length
Summary
The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-length to trigger the issue without affecting the core functionality.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
2 references
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/5/EIP |
Affected:
VC:00 , < VC:07
(semver)
|
|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/10/EIP |
Affected:
VC:00 , < VC:07
(semver)
|
|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/20/EIP |
Affected:
VC:00 , < VC:07
(semver)
|
|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/40/EIP |
Affected:
VC:00 , < VC:07
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-41706",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-14T18:40:44.318321Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-14T18:40:56.043Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T17:44:48.379Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2025/Oct/12"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/5/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/10/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/20/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/40/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "D. Blagojevic, S. Dietz, F. Koroknai, T. Weber from CyberDanube Security Research"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-length to trigger the issue without affecting the core functionality.\u003cbr\u003e"
}
],
"value": "The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-length to trigger the issue without affecting the core functionality."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-14T08:05:56.266Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://certvde.com/de/advisories/VDE-2025-072"
}
],
"source": {
"advisory": "VDE-2025-072",
"defect": [
"CERT@VDE#641835"
],
"discovery": "UNKNOWN"
},
"title": "Phoenix Contact: Webserver Denial of Service through Malformed Content-Length",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2025-41706",
"datePublished": "2025-10-14T08:05:56.266Z",
"dateReserved": "2025-04-16T11:17:48.310Z",
"dateUpdated": "2025-11-03T17:44:48.379Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-41705 (GCVE-0-2025-41705)
Vulnerability from nvd – Published: 2025-10-14 08:05 – Updated: 2025-11-03 17:44
VLAI
EPSS
VEX
Title
Phoenix Contact: WebSocket Message Interception Leaks Webfrontend Credentials
Summary
An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-523 - Unprotected Transport of Credentials
Assigner
References
2 references
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/5/EIP |
Affected:
VC:00 , < VC:07
(semver)
|
|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/10/EIP |
Affected:
VC:00 , < VC:07
(semver)
|
|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/20/EIP |
Affected:
VC:00 , < VC:07
(semver)
|
|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/40/EIP |
Affected:
VC:00 , < VC:07
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-41705",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-14T18:39:39.309928Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-14T18:39:54.898Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T17:44:47.442Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2025/Oct/12"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/5/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/10/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/20/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/40/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "D. Blagojevic, S. Dietz, F. Koroknai, T. Weber from CyberDanube Security Research"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend.\u003cbr\u003e"
}
],
"value": "An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-523",
"description": "CWE-523 Unprotected Transport of Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-14T08:06:21.805Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://certvde.com/de/advisories/VDE-2025-072"
}
],
"source": {
"advisory": "VDE-2025-072",
"defect": [
"CERT@VDE#641835"
],
"discovery": "UNKNOWN"
},
"title": "Phoenix Contact: WebSocket Message Interception Leaks Webfrontend Credentials",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2025-41705",
"datePublished": "2025-10-14T08:05:43.031Z",
"dateReserved": "2025-04-16T11:17:48.310Z",
"dateUpdated": "2025-11-03T17:44:47.442Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-41704 (GCVE-0-2025-41704)
Vulnerability from nvd – Published: 2025-10-14 08:05 – Updated: 2025-11-03 17:44
VLAI
EPSS
VEX
Title
Phoenix Contact: Unauthenticated Modbus Service DoS via Crafted Function Code
Summary
An unauthanticated remote attacker can perform a DoS of the Modbus service by sending a specific function and sub-function code without affecting the core functionality.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
2 references
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/5/EIP |
Affected:
VC:00 , < VC:07
(semver)
|
|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/10/EIP |
Affected:
VC:00 , < VC:07
(semver)
|
|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/20/EIP |
Affected:
VC:00 , < VC:07
(semver)
|
|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/40/EIP |
Affected:
VC:00 , < VC:07
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-41704",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-14T18:39:04.874992Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-14T18:39:22.997Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T17:44:46.483Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2025/Oct/12"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/5/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/10/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/20/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/40/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "D. Blagojevic, S. Dietz, F. Koroknai, T. Weber from CyberDanube Security Research"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An unauthanticated remote attacker can perform a DoS of the Modbus service by sending a specific function and sub-function code without affecting the core functionality.\u003cbr\u003e"
}
],
"value": "An unauthanticated remote attacker can perform a DoS of the Modbus service by sending a specific function and sub-function code without affecting the core functionality."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-14T08:05:34.171Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://certvde.com/de/advisories/VDE-2025-072"
}
],
"source": {
"advisory": "VDE-2025-072",
"defect": [
"CERT@VDE#641835"
],
"discovery": "UNKNOWN"
},
"title": "Phoenix Contact: Unauthenticated Modbus Service DoS via Crafted Function Code",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2025-41704",
"datePublished": "2025-10-14T08:05:34.171Z",
"dateReserved": "2025-04-16T11:17:48.310Z",
"dateUpdated": "2025-11-03T17:44:46.483Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-41703 (GCVE-0-2025-41703)
Vulnerability from nvd – Published: 2025-10-14 08:05 – Updated: 2025-11-03 17:44
VLAI
EPSS
VEX
Title
Phoenix Contact: UPS Shutdown via Unauthenticated Modbus Command
Summary
An unauthenticated remote attacker can cause a Denial of Service by turning off the output of the UPS via Modbus command.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
2 references
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/5/EIP |
Affected:
VC:00 , ≤ VC:07
(semver)
|
|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/10/EIP |
Affected:
VC:00 , ≤ VC:07
(semver)
|
|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/20/EIP |
Affected:
VC:00 , ≤ VC:07
(semver)
|
|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/40/EIP |
Affected:
VC:00 , ≤ VC:07
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-41703",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-14T18:38:31.786647Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-14T18:38:47.646Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T17:44:45.524Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2025/Oct/12"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/5/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThanOrEqual": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/10/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThanOrEqual": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/20/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThanOrEqual": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/40/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThanOrEqual": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "D. Blagojevic, S. Dietz, F. Koroknai, T. Weber from CyberDanube Security Research"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An unauthenticated remote attacker can cause a Denial of Service by turning off the output of the UPS via Modbus command.\u003cbr\u003e"
}
],
"value": "An unauthenticated remote attacker can cause a Denial of Service by turning off the output of the UPS via Modbus command."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-14T08:05:23.395Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://certvde.com/de/advisories/VDE-2025-072"
}
],
"source": {
"advisory": "VDE-2025-072",
"defect": [
"CERT@VDE#641835"
],
"discovery": "UNKNOWN"
},
"title": "Phoenix Contact: UPS Shutdown via Unauthenticated Modbus Command",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2025-41703",
"datePublished": "2025-10-14T08:05:23.395Z",
"dateReserved": "2025-04-16T11:17:48.310Z",
"dateUpdated": "2025-11-03T17:44:45.524Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-41707 (GCVE-0-2025-41707)
Vulnerability from cvelistv5 – Published: 2025-10-14 08:06 – Updated: 2025-11-03 17:44
VLAI
EPSS
VEX
Title
Phoenix Contact: WebSocket Handler Denial of Service
Summary
The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the issue without affecting the core functionality.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
2 references
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/5/EIP |
Affected:
VC:00 , < VC:07
(semver)
|
|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/10/EIP |
Affected:
VC:00 , < VC:07
(semver)
|
|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/20/EIP |
Affected:
VC:00 , < VC:07
(semver)
|
|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/40/EIP |
Affected:
VC:00 , < VC:07
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-41707",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-14T18:41:16.009240Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-14T18:41:30.126Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T17:44:49.327Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2025/Oct/12"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/5/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/10/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/20/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/40/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "D. Blagojevic, S. Dietz, F. Koroknai, T. Weber from CyberDanube Security Research"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the issue without affecting the core functionality.\u003cbr\u003e"
}
],
"value": "The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the issue without affecting the core functionality."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-14T08:06:11.424Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://certvde.com/de/advisories/VDE-2025-072"
}
],
"source": {
"advisory": "VDE-2025-072",
"defect": [
"CERT@VDE#641835"
],
"discovery": "UNKNOWN"
},
"title": "Phoenix Contact: WebSocket Handler Denial of Service",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2025-41707",
"datePublished": "2025-10-14T08:06:11.424Z",
"dateReserved": "2025-04-16T11:17:48.311Z",
"dateUpdated": "2025-11-03T17:44:49.327Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-41706 (GCVE-0-2025-41706)
Vulnerability from cvelistv5 – Published: 2025-10-14 08:05 – Updated: 2025-11-03 17:44
VLAI
EPSS
VEX
Title
Phoenix Contact: Webserver Denial of Service through Malformed Content-Length
Summary
The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-length to trigger the issue without affecting the core functionality.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
2 references
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/5/EIP |
Affected:
VC:00 , < VC:07
(semver)
|
|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/10/EIP |
Affected:
VC:00 , < VC:07
(semver)
|
|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/20/EIP |
Affected:
VC:00 , < VC:07
(semver)
|
|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/40/EIP |
Affected:
VC:00 , < VC:07
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-41706",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-14T18:40:44.318321Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-14T18:40:56.043Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T17:44:48.379Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2025/Oct/12"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/5/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/10/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/20/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/40/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "D. Blagojevic, S. Dietz, F. Koroknai, T. Weber from CyberDanube Security Research"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-length to trigger the issue without affecting the core functionality.\u003cbr\u003e"
}
],
"value": "The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-length to trigger the issue without affecting the core functionality."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-14T08:05:56.266Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://certvde.com/de/advisories/VDE-2025-072"
}
],
"source": {
"advisory": "VDE-2025-072",
"defect": [
"CERT@VDE#641835"
],
"discovery": "UNKNOWN"
},
"title": "Phoenix Contact: Webserver Denial of Service through Malformed Content-Length",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2025-41706",
"datePublished": "2025-10-14T08:05:56.266Z",
"dateReserved": "2025-04-16T11:17:48.310Z",
"dateUpdated": "2025-11-03T17:44:48.379Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-41705 (GCVE-0-2025-41705)
Vulnerability from cvelistv5 – Published: 2025-10-14 08:05 – Updated: 2025-11-03 17:44
VLAI
EPSS
VEX
Title
Phoenix Contact: WebSocket Message Interception Leaks Webfrontend Credentials
Summary
An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-523 - Unprotected Transport of Credentials
Assigner
References
2 references
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/5/EIP |
Affected:
VC:00 , < VC:07
(semver)
|
|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/10/EIP |
Affected:
VC:00 , < VC:07
(semver)
|
|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/20/EIP |
Affected:
VC:00 , < VC:07
(semver)
|
|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/40/EIP |
Affected:
VC:00 , < VC:07
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-41705",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-14T18:39:39.309928Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-14T18:39:54.898Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T17:44:47.442Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2025/Oct/12"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/5/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/10/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/20/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/40/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "D. Blagojevic, S. Dietz, F. Koroknai, T. Weber from CyberDanube Security Research"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend.\u003cbr\u003e"
}
],
"value": "An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-523",
"description": "CWE-523 Unprotected Transport of Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-14T08:06:21.805Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://certvde.com/de/advisories/VDE-2025-072"
}
],
"source": {
"advisory": "VDE-2025-072",
"defect": [
"CERT@VDE#641835"
],
"discovery": "UNKNOWN"
},
"title": "Phoenix Contact: WebSocket Message Interception Leaks Webfrontend Credentials",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2025-41705",
"datePublished": "2025-10-14T08:05:43.031Z",
"dateReserved": "2025-04-16T11:17:48.310Z",
"dateUpdated": "2025-11-03T17:44:47.442Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-41704 (GCVE-0-2025-41704)
Vulnerability from cvelistv5 – Published: 2025-10-14 08:05 – Updated: 2025-11-03 17:44
VLAI
EPSS
VEX
Title
Phoenix Contact: Unauthenticated Modbus Service DoS via Crafted Function Code
Summary
An unauthanticated remote attacker can perform a DoS of the Modbus service by sending a specific function and sub-function code without affecting the core functionality.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
2 references
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/5/EIP |
Affected:
VC:00 , < VC:07
(semver)
|
|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/10/EIP |
Affected:
VC:00 , < VC:07
(semver)
|
|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/20/EIP |
Affected:
VC:00 , < VC:07
(semver)
|
|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/40/EIP |
Affected:
VC:00 , < VC:07
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-41704",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-14T18:39:04.874992Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-14T18:39:22.997Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T17:44:46.483Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2025/Oct/12"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/5/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/10/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/20/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/40/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThan": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "D. Blagojevic, S. Dietz, F. Koroknai, T. Weber from CyberDanube Security Research"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An unauthanticated remote attacker can perform a DoS of the Modbus service by sending a specific function and sub-function code without affecting the core functionality.\u003cbr\u003e"
}
],
"value": "An unauthanticated remote attacker can perform a DoS of the Modbus service by sending a specific function and sub-function code without affecting the core functionality."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-14T08:05:34.171Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://certvde.com/de/advisories/VDE-2025-072"
}
],
"source": {
"advisory": "VDE-2025-072",
"defect": [
"CERT@VDE#641835"
],
"discovery": "UNKNOWN"
},
"title": "Phoenix Contact: Unauthenticated Modbus Service DoS via Crafted Function Code",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2025-41704",
"datePublished": "2025-10-14T08:05:34.171Z",
"dateReserved": "2025-04-16T11:17:48.310Z",
"dateUpdated": "2025-11-03T17:44:46.483Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-41703 (GCVE-0-2025-41703)
Vulnerability from cvelistv5 – Published: 2025-10-14 08:05 – Updated: 2025-11-03 17:44
VLAI
EPSS
VEX
Title
Phoenix Contact: UPS Shutdown via Unauthenticated Modbus Command
Summary
An unauthenticated remote attacker can cause a Denial of Service by turning off the output of the UPS via Modbus command.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
2 references
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/5/EIP |
Affected:
VC:00 , ≤ VC:07
(semver)
|
|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/10/EIP |
Affected:
VC:00 , ≤ VC:07
(semver)
|
|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/20/EIP |
Affected:
VC:00 , ≤ VC:07
(semver)
|
|
| Phoenix Contact | QUINT4-UPS/24DC/24DC/40/EIP |
Affected:
VC:00 , ≤ VC:07
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-41703",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-14T18:38:31.786647Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-14T18:38:47.646Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T17:44:45.524Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2025/Oct/12"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/5/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThanOrEqual": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/10/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThanOrEqual": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/20/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThanOrEqual": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QUINT4-UPS/24DC/24DC/40/EIP",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThanOrEqual": "VC:07",
"status": "affected",
"version": "VC:00",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "D. Blagojevic, S. Dietz, F. Koroknai, T. Weber from CyberDanube Security Research"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An unauthenticated remote attacker can cause a Denial of Service by turning off the output of the UPS via Modbus command.\u003cbr\u003e"
}
],
"value": "An unauthenticated remote attacker can cause a Denial of Service by turning off the output of the UPS via Modbus command."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-14T08:05:23.395Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://certvde.com/de/advisories/VDE-2025-072"
}
],
"source": {
"advisory": "VDE-2025-072",
"defect": [
"CERT@VDE#641835"
],
"discovery": "UNKNOWN"
},
"title": "Phoenix Contact: UPS Shutdown via Unauthenticated Modbus Command",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2025-41703",
"datePublished": "2025-10-14T08:05:23.395Z",
"dateReserved": "2025-04-16T11:17:48.310Z",
"dateUpdated": "2025-11-03T17:44:45.524Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}