Phoenix Contact QUINT4-ups/24dc/24dc/10/eip vulnerabilities

5 CVEs affecting Phoenix Contact QUINT4-ups/24dc/24dc/10/eip, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-41707, published 2025-10-14.

More from Phoenix Contact.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-41706, published 2025-10-14. Medium severity, CVSS 5.3. EPSS: 1.7% chance of exploitation in the next 30 days. The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-length to trigger the issue without…
• CVE-2025-41704, published 2025-10-14. Medium severity, CVSS 5.3. EPSS: 1.6% chance of exploitation in the next 30 days. An unauthanticated remote attacker can perform a DoS of the Modbus service by sending a specific function and sub-function code without affecting the core functionality.
• CVE-2025-41707, published 2025-10-14. Medium severity, CVSS 5.3. EPSS: 1.4% chance of exploitation in the next 30 days. The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the issue without affecting the core…
• CVE-2025-41703, published 2025-10-14. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. An unauthenticated remote attacker can cause a Denial of Service by turning off the output of the UPS via Modbus command.
• CVE-2025-41705, published 2025-10-14. Medium severity, CVSS 6.8. EPSS: 0.5% chance of exploitation in the next 30 days. An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend.