CVE-2025-41670: Phoenix Contact Axc F 1152

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

A local user with low privileges may be able to influence the behavior of a privileged system service by manipulating configuration or application-related files located in user-writable areas of the filesystem. The affected service processes data from locations that are not sufficiently protected against modification by low-privileged users. As the service runs with elevated privileges, successful exploitation may result in a local privilege escalation.

Affected products

• Phoenix Contact Axc F 1152: from 0.0.0, before 2026.0.3 (fixed in 2026.0.3)
• Phoenix Contact Axc F 1252: from 0.0.0, before 2026.0.3 (fixed in 2026.0.3)
• Phoenix Contact Axc F 2000 Ea: from 0.0.0, before 2026.0.3 (fixed in 2026.0.3)
• Phoenix Contact Axc F 2152: from 0.0.0, before 2026.0.3 (fixed in 2026.0.3)
• Phoenix Contact Axc F 3152: from 0.0.0, before 2026.0.3 (fixed in 2026.0.3)
• Phoenix Contact Bpc 9102s: from 0.0.0, before 2026.0.3 (fixed in 2026.0.3)
• Phoenix Contact Epc 1522: from 0.0.0, before 2026.0.3 (fixed in 2026.0.3)
• Phoenix Contact Rfc 4072r: from 0.0.0, before 2026.0.3 (fixed in 2026.0.3)
• Phoenix Contact Rfc 4072s: from 0.0.0, before 2026.0.3 (fixed in 2026.0.3)
• Phoenix Contact VL3 Upc 2440 Edge: from 0.0.0, before 2026.0.3 (fixed in 2026.0.3)
• Phoenix Contact Vplcnext Control 1000: from 0.0.0, before 2026.0.3 (fixed in 2026.0.3)
• Phoenix Contact Vplcnext Control 2000: from 0.0.0, before 2026.0.3 (fixed in 2026.0.3)
• Phoenix Contact Vplcnext Control 3000: from 0.0.0, before 2026.0.3 (fixed in 2026.0.3)
• Phoenix Contact Vplcnext Control 500: from 0.0.0, before 2026.0.3 (fixed in 2026.0.3)

Published 2026-05-27. Last modified 2026-06-17.