CVE-2025-41717: Config-Upload Code Injection

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-13 · updated 2026-06-17
Weakness: CWE-94

Description

An unauthenticated remote attacker can trick a high privileged user into uploading a malicious payload via the config-upload endpoint, leading to code injection as root. This results in a total loss of confidentiality, availability and integrity due to improper control of code generation ('Code Injection’).

Affected products

PHOENIX CONTACT CLOUD CLIENT 1101T-TX/TX: before 3.07.7 — fixed in 3.07.7
PHOENIX CONTACT TC CLOUD CLIENT 1002-4G ATT: before 3.08.8 — fixed in 3.08.8
Phoenix Contact TC CLOUD CLIENT 1002-TX/TX: before 3.07.7 — fixed in 3.07.7
Phoenix Contact TC ROUTER 2002T-3G: before 3.08.8 — fixed in 3.08.8
Phoenix Contact TC ROUTER 2002T-4G: before 3.08.8 — fixed in 3.08.8
Phoenix Contact TC ROUTER 3002T-3G: before 3.08.8 — fixed in 3.08.8
PHOENIX CONTACT TC ROUTER 3002T-4G: before 3.08.8 — fixed in 3.08.8
PHOENIX CONTACT TC ROUTER 3002T-4G ATT: before 3.08.8 — fixed in 3.08.8
Phoenix Contact TC ROUTER 3002T-4G GL: before 3.08.8 — fixed in 3.08.8
PHOENIX CONTACT TC ROUTER 3002T-4G VZW: before 3.08.8 — fixed in 3.08.8
Phoenix Contact TC ROUTER 5004T-5G EU: before 1.06.23 — fixed in 1.06.23

How to fix

Upgrade to a fixed version: PHOENIX CONTACT CLOUD CLIENT 1101T-TX/TX 3.07.7; PHOENIX CONTACT TC CLOUD CLIENT 1002-4G ATT 3.08.8; Phoenix Contact TC CLOUD CLIENT 1002-TX/TX 3.07.7; Phoenix Contact TC ROUTER 2002T-3G 3.08.8; Phoenix Contact TC ROUTER 2002T-4G 3.08.8; Phoenix Contact TC ROUTER 3002T-3G 3.08.8; PHOENIX CONTACT TC ROUTER 3002T-4G 3.08.8; PHOENIX CONTACT TC ROUTER 3002T-4G ATT 3.08.8; Phoenix Contact TC ROUTER 3002T-4G GL 3.08.8; PHOENIX CONTACT TC ROUTER 3002T-4G VZW 3.08.8; Phoenix Contact TC ROUTER 5004T-5G EU 1.06.23. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-41717 or the next vulnerability affects your stack