CVE-2025-41669Disclosure

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Web-based Management allows a remote low privileged Engineer user to install additional APPs on the device downloaded from the PLCnext Store without implementing any data verification mechanism, leading to the capability for an Engineer user to reach arbitrary code execution with root privileges on the PLC device. A successful exploitation may allow to install a manipulated APP package, potentially impacting integrity and availability of the PLCnext Control.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://www.certvde.com/en/advisories/VDE-2026-050/

Weakness type (CWE)

CWE-347

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-06-02); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets1 URL

By indicator

https://threatcluster.io/cluster/privilege-escalation-vulnerabilities-in-phoenix-plcnext-cont-ec2aa01a

Full discourse2 posts

DFIR Radar@DFIR_Radar136d
Disclosure
CVE-2025-41669 (CVSS 8.8) in Phoenix Contact PLCnext controllers allows Engineer-role users to escalate to root via unsigned app installation. Affects factory automation and critical infrastructure. #DFIR_Radar https://t.co/n0LgI6E2un
Post summary
The tweet announces CVE-2025-41669, detailing a privilege‑escalation flaw in Phoenix Contact PLCnext controllers with a high CVSS score, but provides no PoC, exploit, patch, or evidence of active exploitation.
10010197
1.8K followersView on X
ThreatCluster@threatcluster137d
Disclosure
BREAKING: Nozomi Networks reveals CVE-2025-41669 privilege escalation chain in Phoenix PLCnext AXC F 3152, letting Engineer-profile users gain root on industrial controllers. https://threatcluster.io/cluster/privilege-escalation-vulnerabilities-in-phoenix-plcnext-cont-ec2aa01a
Post summary
Nozomi Networks has disclosed a privilege‑escalation vulnerability (CVE‑2025‑41669) in Phoenix PLCnext controllers that permits engineer‑profile users to attain root access. No exploit code, patch, or evidence of active exploitation is mentioned.
0000049
294 followersView on X

Explore more

Back to dashboard