CVE-2025-41771 — SQL injection

Description (CNA)

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification functionality.

Affected (CNA)

Vendor / product	Versions
Phoenix Contact / AXC F 1152	affected 2019.0.4 before 2026.0.3
Phoenix Contact / AXC F 1252	affected 2019.0.4 before 2026.0.3
Phoenix Contact / AXC F 2000 EA	affected 2019.0.4 before 2026.0.3
Phoenix Contact / AXC F 2152	affected 2019.0.4 before 2026.0.3
Phoenix Contact / AXC F 3152	affected 2019.0.4 before 2026.0.3
Phoenix Contact / BPC 9102S	affected 2019.0.4 before 2026.0.3
Phoenix Contact / BPC 9202S	affected 2019.0.4 before 2026.0.3
Phoenix Contact / RFC 4072R	affected 2019.0.4 before 2026.0.3
Phoenix Contact / RFC 4072S	affected 2019.0.4 before 2026.0.3
Phoenix Contact / VL3 UPC 2440 EDGE	affected 2019.0.4 before 2026.0.3
Phoenix Contact / VPLCNEXT CONTROL 1000	affected 2019.0.4 before 2026.0.3
Phoenix Contact / VPLCNEXT CONTROL 2000	affected 2019.0.4 before 2026.0.3
Phoenix Contact / VPLCNEXT CONTROL 3000	affected 2019.0.4 before 2026.0.3
Phoenix Contact / VPLCNEXT CONTROL 500	affected 2019.0.4 before 2026.0.3
Phoenix Contact / Catan C1	affected 2019.0.4 before 2026.0.3
Phoenix Contact / EPC 1502	affected 2019.0.4 before 2026.0.3
Phoenix Contact / EPC 1522	affected 2019.0.4 before 2026.0.3

CWE

CWE-89

References

https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2025-056.json

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.