Phoenix Contact PLCnext Watchdog File Manipulation Vulnerability Allowing Unauthorized File Access

A vulnerability exists in Phoenix Contact PLCnext firmware versions prior to 2025.0.2, allowing low-privileged remote attackers with file access to replace a critical file used by the watchdog service. This manipulation can lead to unauthorized read, write, and execute access to any file on the device, after the watchdog has been initialized.

Impact

Exploitation of this vulnerability could compromise the availability, integrity, or confidentiality of the affected PLCnext Control device.

Remediation

Users are advised to update to the latest firmware version 2025.0.2. Phoenix Contact recommends always using an up-to-date version of PLCnext Engineer.