{ "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination.", "urls": [ "https://certvde.com" ] }, { "organization": "Wibu-Systems", "summary": "Reporting.", "urls": [ "https://www.wibu.com/support/security-advisories.html" ] }, { "organization": "Vector Informatik GmbH Andrew Teylu", "summary": "Reporting." } ], "aggregate_severity": { "namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale", "text": "High" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "general", "text": "Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our [Application note](https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf).", "title": "General Recommendation" }, { "category": "description", "text": "The reported vulnerabilities allow unauthenticated attackers to read and overwrite sensitive configuration data and to crash CodeMeter Runtime which has only an impact on the licensing infrastructure. Licenses then are not accessible anymore. These security vulnerabilities may occur on PLCnext devices or Virtual Controls with an integrated CodeMeter Runtime (see affected products).", "title": "Impact" }, { "category": "description", "text": "Please check the Phoenix Contact e-Shop regularly to see if the fixed firmware is already available for your specific PLCnext device or Virtual PLCnext Control. The Fix is planned to be integrated in version 2026.0.6 which is planned for Q4/2026.", "title": "Remediation" }, { "category": "summary", "text": "This advisory addresses security vulnerabilities in Phoenix Contact products with an integrated CodeMeter Runtime, like PLCnext devices and Virtual Controls. These security vulnerabilities only may occur with versions <8.41a of the integrated software CodeMeter Runtime from Wibu-Systems. Please see listed products to determine which devices and firmware versions are affected.", "title": "Summary" }, { "category": "description", "text": "For affected PLCnext devices and Virtual Controls with an integrated Codemeter Runtime (see affected products), PHOENIX CONTACT strongly recommends to follow the descriptions below:\n\nOn PLCnext devices switch on the firewall via the WBM to avoid an unauthenticated access.", "title": "Mitigation" } ], "publisher": { "category": "vendor", "contact_details": "psirt@phoenixcontact.com", "name": "Phoenix Contact GmbH & Co. KG", "namespace": "https://phoenixcontact.com/psirt" }, "references": [ { "category": "external", "summary": "PCSA-2026-00009", "url": "https://phoenixcontact.com/psirt" }, { "category": "external", "summary": "Phoenix Contact advisory overview at CERT@VDE", "url": "https://certvde.com/de/advisories/vendor/phoenixcontact" }, { "category": "self", "summary": "VDE-2026-084: Phoenix Contact: CodeMeter Runtime Security Vulnerabilities in License Validation in the PLCnext Firmware - HTML", "url": "https://certvde.com/en/advisories/vde-2026-084" }, { "category": "self", "summary": "VDE-2026-084: Phoenix Contact: CodeMeter Runtime Security Vulnerabilities in License Validation in the PLCnext Firmware - CSAF", "url": "https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-084.json" } ], "source_lang": "en", "title": "Phoenix Contact: CodeMeter Runtime Security Vulnerabilities in License Validation in the PLCnext Firmware", "tracking": { "aliases": [ "VDE-2026-084", "PCSA-2026-00009" ], "current_release_date": "2026-11-04T11:00:00.000Z", "generator": { "date": "2026-11-03T16:56:14.599Z", "engine": { "name": "Secvisogram", "version": "2.6.16" } }, "id": "VDE-2026-084", "initial_release_date": "2026-11-04T11:00:00.000Z", "revision_history": [ { "date": "2026-11-04T11:00:00.000Z", "number": "1.0.0", "summary": "Initial" } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Catan C1", "product": { "name": "Catan C1", "product_id": "CSAFPID-11017", "product_identification_helper": { "cpe": "cpe:2.3:h:phoenix_contact:catan_c1:*:*:*:*:*:*:*:*", "model_numbers": [ "1886438" ] } } }, { "category": "product_name", "name": "AXC F 1152", "product": { "name": "AXC F 1152", "product_id": "CSAFPID-11001", "product_identification_helper": { "cpe": "cpe:2.3:h:phoenix_contact:axc_f_1152:*:*:*:*:*:*:*:*", "model_numbers": [ "1151412" ] } } }, { "category": "product_name", "name": "AXC F 1252", "product": { "name": "AXC F 1252", "product_id": "CSAFPID-11012", "product_identification_helper": { "cpe": "cpe:2.3:h:phoenix_contact:axc_f_1252:*:*:*:*:*:*:*:*", "model_numbers": [ "1646469" ] } } }, { "category": "product_name", "name": "AXC F 2000 EA", "product": { "name": "AXC F 2000 EA", "product_id": "CSAFPID-11013", "product_identification_helper": { "cpe": "cpe:2.3:h:phoenix_contact:axc_f_2000_ea:*:*:*:*:*:*:*:*", "model_numbers": [ "1551772" ] } } }, { "category": "product_name", "name": "AXC F 2152", "product": { "name": "AXC F 2152", "product_id": "CSAFPID-11002", "product_identification_helper": { "cpe": "cpe:2.3:h:phoenix_contact:axc_f_2152:*:*:*:*:*:*:*:*", "model_numbers": [ "2404267" ] } } }, { "category": "product_name", "name": "AXC F 3152", "product": { "name": "AXC F 3152", "product_id": "CSAFPID-11003", "product_identification_helper": { "cpe": "cpe:2.3:h:phoenix_contact:axc_f_3152:*:*:*:*:*:*:*:*", "model_numbers": [ "1069208" ] } } }, { "category": "product_name", "name": "BPC 9102S", "product": { "name": "BPC 9102S", "product_id": "CSAFPID-11011", "product_identification_helper": { "cpe": "cpe:2.3:h:phoenix_contact:bpc_9102s:*:*:*:*:*:*:*:*", "model_numbers": [ "1246285" ] } } }, { "category": "product_name", "name": "BPC 9202S", "product": { "name": "BPC 9202S", "product_id": "CSAFPID-11005", "product_identification_helper": { "cpe": "cpe:2.3:h:phoenix_contact:bpc_9202s:*:*:*:*:*:*:*:*", "model_numbers": [ "1839159" ] } } }, { "category": "product_name", "name": "RFC 4072R", "product": { "name": "RFC 4072R", "product_id": "CSAFPID-11014", "product_identification_helper": { "cpe": "cpe:2.3:h:phoenix_contact:rfc_4072r:*:*:*:*:*:*:*:*", "model_numbers": [ "1136419" ] } } }, { "category": "product_name", "name": "RFC 4072S", "product": { "name": "RFC 4072S", "product_id": "CSAFPID-11004", "product_identification_helper": { "cpe": "cpe:2.3:h:phoenix_contact:rfc_4072s:*:*:*:*:*:*:*:*", "model_numbers": [ "1051328" ] } } }, { "category": "product_name", "name": "VL3 UPC 2440 EDGE", "product": { "name": "VL3 UPC 2440 EDGE", "product_id": "CSAFPID-11015", "product_identification_helper": { "cpe": "cpe:2.3:h:phoenix_contact:vl3_upc_2440_edge:*:*:*:*:*:*:*:*", "model_numbers": [ "1760157" ] } } }, { "category": "product_name", "name": "VPLCNEXT CONTROL 1000", "product": { "name": "VPLCNEXT CONTROL 1000", "product_id": "CSAFPID-11031", "product_identification_helper": { "cpe": "cpe:2.3:h:phoenix_contact:vplcnext_control_1000:*:*:*:*:*:*:*:*", "model_numbers": [ "1737875" ] } } }, { "category": "product_name", "name": "VPLCNEXT CONTROL 2000", "product": { "name": "VPLCNEXT CONTROL 2000", "product_id": "CSAFPID-11032", "product_identification_helper": { "cpe": "cpe:2.3:h:phoenix_contact:vplcnext_control_2000:*:*:*:*:*:*:*:*", "model_numbers": [ " 1738453 " ] } } }, { "category": "product_name", "name": "VPLCNEXT CONTROL 3000", "product": { "name": "VPLCNEXT CONTROL 3000", "product_id": "CSAFPID-11033", "product_identification_helper": { "cpe": "cpe:2.3:h:phoenix_contact:vplcnext_control_3000:*:*:*:*:*:*:*:*", "model_numbers": [ " 1738454" ] } } }, { "category": "product_name", "name": "VPLCNEXT CONTROL 500", "product": { "name": "VPLCNEXT CONTROL 500", "product_id": "CSAFPID-11030", "product_identification_helper": { "cpe": "cpe:2.3:h:phoenix_contact:vplcnext_control_500:*:*:*:*:*:*:*:*", "model_numbers": [ "1751491" ] } } } ], "category": "product_family", "name": "Hardware" }, { "branches": [ { "category": "product_version_range", "name": "vers:generic/>=2025.0|<2026.0.6", "product": { "name": "Firmware 2025.0 <2026.0.6", "product_id": "CSAFPID-21001", "product_identification_helper": { "cpe": "cpe:2.3:o:phoenix_contact:plcnext_firmware:*:*:*:*:*:*:*:*", "model_numbers": [ "1151412", "1646469", "1551772", "2404267", "1069208", "1246285", "1185423", "1136419", "1051328", "1760157", "1737875", "1738453", "1738454", "1751491" ] } } }, { "category": "product_version", "name": "2026.0.6", "product": { "name": "Firmware 2026.0.6", "product_id": "CSAFPID-22001", "product_identification_helper": { "cpe": "cpe:2.3:o:phoenix_contact:charx_sec3xxx_firmware:2026.0.6:*:*:*:*:*:*:*", "model_numbers": [ "1151412", "1646469", "1551772", "2404267", "1069208", "1246285", "1185423", "1136419", "1051328", "1760157", "1737875", "1738453", "1738454", "1751491" ] } } } ], "category": "product_family", "name": "Firmware" } ], "category": "vendor", "name": "Phoenix Contact" }, { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:generic/>=8.0|<8.41a", "product": { "name": "CodeMeter Runtime 8.0 <8.41a", "product_id": "CSAFPID-51001", "product_identification_helper": { "cpe": "cpe:2.3:o:wibu_systems_ag:codemeter_runtime:*:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "8.41a", "product": { "name": "CodeMeter Runtime 8.41a", "product_id": "CSAFPID-52001", "product_identification_helper": { "cpe": "cpe:2.3:o:wibu_systems_ag:codemeter_runtime:8.41a:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "CodeMeter Runtime" } ], "category": "product_family", "name": "Software" } ], "category": "vendor", "name": "WIBU-SYSTEMS AG" } ], "product_groups": [ { "group_id": "CSAFGID-0001", "product_ids": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-51001" ], "summary": "Affected Products." }, { "group_id": "CSAFGID-0002", "product_ids": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014", "CSAFPID-32015", "CSAFPID-52001" ], "summary": "Planned Fixed Products in Q4/2026." } ], "relationships": [ { "category": "installed_on", "full_product_name": { "name": "Firmware 2026.0 <2026.0.6 installed on Catan C1", "product_id": "CSAFPID-31015", "product_identification_helper": { "cpe": "cpe:2.3:o:phoenix_contact:catan_c1_firmware:*:*:*:*:*:*:*:*", "model_numbers": [ "1886438" ] } }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11017" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 2026.0.6 installed on Catan C1", "product_id": "CSAFPID-32015", "product_identification_helper": { "cpe": "cpe:2.3:o:phoenix_contact:catan_c1_firmware:2026.0.6:*:*:*:*:*:*:*", "model_numbers": [ "1886438" ] } }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11017" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 2025.0 <2026.0.6 installed on AXC F 1152", "product_id": "CSAFPID-31001", "product_identification_helper": { "cpe": "cpe:2.3:o:phoenix_contact:axc_f_1152_firmware:*:*:*:*:*:*:*:*", "model_numbers": [ "1151412" ] } }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11001" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 2026.0.6 installed on AXC F 1152", "product_id": "CSAFPID-32001", "product_identification_helper": { "cpe": "cpe:2.3:o:phoenix_contact:axc_f_1152_firmware:2026.0.6:*:*:*:*:*:*:*", "model_numbers": [ "1151412" ] } }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11001" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 2025.0 <2026.0.6 installed on AXC F 1252", "product_id": "CSAFPID-31002", "product_identification_helper": { "cpe": "cpe:2.3:o:phoenix_contact:axc_f_1252_firmware:*:*:*:*:*:*:*:*", "model_numbers": [ "1646469" ] } }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11012" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 2026.0.6 installed on AXC F 1252", "product_id": "CSAFPID-32002", "product_identification_helper": { "cpe": "cpe:2.3:o:phoenix_contact:axc_f_1252_firmware:2026.0.6:*:*:*:*:*:*:*", "model_numbers": [ "1646469" ] } }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11012" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 2025.0 <2026.0.6 installed on AXC F 2000 EA", "product_id": "CSAFPID-31003", "product_identification_helper": { "cpe": "cpe:2.3:o:phoenix_contact:axc_f_2000_ea_firmware:*:*:*:*:*:*:*:*", "model_numbers": [ "1551772" ] } }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11013" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 2026.0.6 installed on AXC F 2000 EA", "product_id": "CSAFPID-32003", "product_identification_helper": { "cpe": "cpe:2.3:o:phoenix_contact:axc_f_2000_ea_firmware:2026.0.6:*:*:*:*:*:*:*", "model_numbers": [ "1551772" ] } }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11013" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 2025.0 <2026.0.6 installed on AXC F 2152", "product_id": "CSAFPID-31004", "product_identification_helper": { "cpe": "cpe:2.3:o:phoenix_contact:axc_f_2152_firmware:*:*:*:*:*:*:*:*", "model_numbers": [ "2404267" ] } }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11002" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 2026.0.6 installed on AXC F 2152", "product_id": "CSAFPID-32004", "product_identification_helper": { "cpe": "cpe:2.3:o:phoenix_contact:axc_f_2152_firmware:2026.0.6:*:*:*:*:*:*:*", "model_numbers": [ "2404267" ] } }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11002" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 2025.0 <2026.0.6 installed on AXC F 3152", "product_id": "CSAFPID-31005", "product_identification_helper": { "cpe": "cpe:2.3:o:phoenix_contact:axc_f_3152_firmware:*:*:*:*:*:*:*:*", "model_numbers": [ "1069208" ] } }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11003" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 2026.0.6 installed on AXC F 3152", "product_id": "CSAFPID-32005", "product_identification_helper": { "cpe": "cpe:2.3:o:phoenix_contact:axc_f_3152_firmware:2026.0.6:*:*:*:*:*:*:*", "model_numbers": [ "1069208" ] } }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11003" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 2025.0 <2026.0.6 installed on BPC 9102S", "product_id": "CSAFPID-31006", "product_identification_helper": { "cpe": "cpe:2.3:o:phoenix_contact:bpc_9102s_firmware:*:*:*:*:*:*:*:*", "model_numbers": [ "1246285" ] } }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11011" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 2026.0.6 installed on BPC 9102S", "product_id": "CSAFPID-32006", "product_identification_helper": { "cpe": "cpe:2.3:o:phoenix_contact:bpc_9102s_firmware:2026.0.6:*:*:*:*:*:*:*", "model_numbers": [ "1246285" ] } }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11011" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 2025.0 <2026.0.6 installed on BPC 9202S", "product_id": "CSAFPID-31007", "product_identification_helper": { "cpe": "cpe:2.3:o:phoenix_contact:bpc_9202s_firmware:*:*:*:*:*:*:*:*", "model_numbers": [ "1246285" ] } }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11005" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 2026.0.6 installed on BPC 9202S", "product_id": "CSAFPID-32007", "product_identification_helper": { "cpe": "cpe:2.3:o:phoenix_contact:bpc_9202s_firmware:2026.0.6:*:*:*:*:*:*:*", "model_numbers": [ "1246285" ] } }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11005" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 2025.0 <2026.0.6 installed on RFC 4072R", "product_id": "CSAFPID-31008", "product_identification_helper": { "cpe": "cpe:2.3:o:phoenix_contact:rfc_4072r_firmware:*:*:*:*:*:*:*:*", "model_numbers": [ "1136419" ] } }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11014" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 2026.0.6 installed on RFC 4072R", "product_id": "CSAFPID-32008", "product_identification_helper": { "cpe": "cpe:2.3:o:phoenix_contact:rfc_4072r_firmware:2026.0.6:*:*:*:*:*:*:*", "model_numbers": [ "1136419" ] } }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11014" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 2025.0 <2026.0.6 installed on RFC 4072S", "product_id": "CSAFPID-31009", "product_identification_helper": { "cpe": "cpe:2.3:o:phoenix_contact:rfc_4072s_firmware:*:*:*:*:*:*:*:*", "model_numbers": [ "1051328" ] } }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11004" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 2026.0.6 installed on RFC 4072S", "product_id": "CSAFPID-32009", "product_identification_helper": { "cpe": "cpe:2.3:o:phoenix_contact:rfc_4072s_firmware:2026.0.6:*:*:*:*:*:*:*", "model_numbers": [ "1051328" ] } }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11004" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 2025.0 <2026.0.6 installed on VL3 UPC 2440 EDGE", "product_id": "CSAFPID-31010", "product_identification_helper": { "cpe": "cpe:2.3:o:phoenix_contact:vl3_upc_2440_edge_firmware:*:*:*:*:*:*:*:*", "model_numbers": [ "1760157" ] } }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11015" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 2026.0.6 installed on VL3 UPC 2440 EDGE", "product_id": "CSAFPID-32010", "product_identification_helper": { "cpe": "cpe:2.3:o:phoenix_contact:vl3_upc_2440_edge_firmware:2026.0.6:*:*:*:*:*:*:*", "model_numbers": [ "1760157" ] } }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11015" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 2025.0 <2026.0.6 installed on VPLCNEXT CONTROL 1000", "product_id": "CSAFPID-31011", "product_identification_helper": { "cpe": "cpe:2.3:o:phoenix_contact:vplcnext_control_1000_firmware:*:*:*:*:*:*:*:*", "model_numbers": [ "1737875" ] } }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11031" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 2026.0.6 installed on VPLCNEXT CONTROL 1000", "product_id": "CSAFPID-32011", "product_identification_helper": { "cpe": "cpe:2.3:o:phoenix_contact:vplcnext_control_1000_firmware:2026.0.6:*:*:*:*:*:*:*", "model_numbers": [ "1737875" ] } }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11031" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 2025.0 <2026.0.6 installed on VPLCNEXT CONTROL 2000", "product_id": "CSAFPID-31012", "product_identification_helper": { "cpe": "cpe:2.3:o:phoenix_contact:vplcnext_control_2000_firmware:*:*:*:*:*:*:*:*", "model_numbers": [ " 1738453 " ] } }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11032" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 2026.0.6 installed on VPLCNEXT CONTROL 2000", "product_id": "CSAFPID-32012", "product_identification_helper": { "cpe": "cpe:2.3:o:phoenix_contact:vplcnext_control_2000_firmware:2026.0.6:*:*:*:*:*:*:*", "model_numbers": [ " 1738453 " ] } }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11032" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 2025.0 <2026.0.6 installed on VPLCNEXT CONTROL 3000", "product_id": "CSAFPID-31013", "product_identification_helper": { "cpe": "cpe:2.3:o:phoenix_contact:vplcnext_control_3000_firmware:*:*:*:*:*:*:*:*", "model_numbers": [ " 1738454" ] } }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11033" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 2026.0.6 installed on VPLCNEXT CONTROL 3000", "product_id": "CSAFPID-32013", "product_identification_helper": { "cpe": "cpe:2.3:o:phoenix_contact:vplcnext_control_3000_firmware:2026.0.6:*:*:*:*:*:*:*", "model_numbers": [ " 1738454" ] } }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11033" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 2025.0 <2026.0.6 installed on VPLCNEXT CONTROL 500", "product_id": "CSAFPID-31014", "product_identification_helper": { "cpe": "cpe:2.3:o:phoenix_contact:vplcnext_control_500_firmware:*:*:*:*:*:*:*:*", "model_numbers": [ "1751491" ] } }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11030" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 2026.0.6 installed on VPLCNEXT CONTROL 500", "product_id": "CSAFPID-32014", "product_identification_helper": { "cpe": "cpe:2.3:o:phoenix_contact:vplcnext_control_500_firmware:2026.0.6:*:*:*:*:*:*:*", "model_numbers": [ "1751491" ] } }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11030" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-81573", "cwe": { "id": "CWE-284", "name": "Improper Access Control" }, "notes": [ { "category": "description", "text": "If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions. Commands intended only for local or same-network clients can therefore be executed by arbitrary remote peers. An attacker can read potentially sensitive configuration data and overwrite selected values in Server.ini. This does include the hash of the credentials for the CodeMeter WebAdmin, enabling WebAdmin takeover.", "title": "CVE description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-51001" ] }, "remediations": [ { "category": "none_available", "details": "Please check the Phoenix Contact e-Shop regularly to see if the fixed firmware is already available for your specific PLCnext device or Virtual PLCnext Control. The Fix is planned to be integrated in version 2026.0.6 which is planned for Q4/2026.", "group_ids": [ "CSAFGID-0001" ], "restart_required": { "category": "system" } }, { "category": "mitigation", "details": "For affected PLCnext devices and Virtual Controls with an integrated Codemeter Runtime (see affected products), PHOENIX CONTACT strongly recommends to follow the descriptions below:\n\nOn PLCnext devices switch on the firewall via the WBM to avoid an unauthenticated access.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "environmentalScore": 8.6, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 8.6, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-51001" ] } ], "title": "Improper Access Control in Local-Only Configuration Commands" }, { "cve": "CVE-2026-81574", "cwe": { "id": "CWE-134", "name": "Use of Externally-Controlled Format String" }, "notes": [ { "category": "description", "text": "In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format specifiers. This can be used to reliably crash CodeMeter and disclose sensitive information such as process memory and stack canaries. The attack works locally, for example by using cmu --set-proxy to set the proxy value, and remotely when combined with CVE-2026-81573 by setting General.ProxyServer and then triggering this vulnerability.", "title": "CVE description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-51001" ] }, "remediations": [ { "category": "none_available", "details": "Please check the Phoenix Contact e-Shop regularly to see if the fixed firmware is already available for your specific PLCnext device or Virtual PLCnext Control. The Fix is planned to be integrated in version 2026.0.6 which is planned for Q4/2026.", "group_ids": [ "CSAFGID-0001" ], "restart_required": { "category": "system" } }, { "category": "mitigation", "details": "For affected PLCnext devices and Virtual Controls with an integrated Codemeter Runtime (see affected products), PHOENIX CONTACT strongly recommends to follow the descriptions below:\n\nOn PLCnext devices switch on the firewall via the WBM to avoid an unauthenticated access.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "environmentalScore": 8.2, "environmentalSeverity": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 8.2, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-51001" ] } ], "title": "Format String Vulnerability in Logger " }, { "cve": "CVE-2026-81575", "cwe": { "id": "CWE-130", "name": "Improper Handling of Length Parameter Inconsistency" }, "notes": [ { "category": "description", "text": "If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data length and the data itself. Missing bounds checking on the data length value can lead to out of bounds reads, causing a segmentation fault that ultimately crashes the CodeMeter Runtime.", "title": "CVE description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-51001" ] }, "remediations": [ { "category": "none_available", "details": "Please check the Phoenix Contact e-Shop regularly to see if the fixed firmware is already available for your specific PLCnext device or Virtual PLCnext Control. The Fix is planned to be integrated in version 2026.0.6 which is planned for Q4/2026.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "mitigation", "details": "For affected PLCnext devices and Virtual Controls with an integrated Codemeter Runtime (see affected products), PHOENIX CONTACT strongly recommends to follow the descriptions below:\n\nOn PLCnext devices switch on the firewall via the WBM to avoid an unauthenticated access.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 7.5, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-51001" ] } ], "title": "Missing Sanity Checks for Buffer Lengths " }, { "cve": "CVE-2026-81576", "cwe": { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key" }, "notes": [ { "category": "description", "text": "If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak SID as sole authenticator. An attacker can brute-force the SID, recover another session's handle number, and read license information belonging to another handle.", "title": "CVE description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-51001" ] }, "remediations": [ { "category": "none_available", "details": "Please check the Phoenix Contact e-Shop regularly to see if the fixed firmware is already available for your specific PLCnext device or Virtual PLCnext Control. The Fix is planned to be integrated in version 2026.0.6 which is planned for Q4/2026.", "group_ids": [ "CSAFGID-0001" ], "restart_required": { "category": "system" } }, { "category": "mitigation", "details": "For affected PLCnext devices and Virtual Controls with an integrated Codemeter Runtime (see affected products), PHOENIX CONTACT strongly recommends to follow the descriptions below:\n\nOn PLCnext devices switch on the firewall via the WBM to avoid an unauthenticated access.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 7.7, "environmentalSeverity": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "temporalScore": 7.7, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-51001" ] } ], "title": "Improper Authentication of Session Handles" } ] }