Unauthenticated Denial-of-Service Vulnerability in PLCnext Engineer

CVE-2025-41770 is a high-severity denial-of-service vulnerability discovered in the communication interface of Phoenix Contact's PLCnext Engineer software. The flaw allows an unauthenticated remote attacker to send specially crafted network traffic to the communication port used by the client application. Successful exploitation of this vulnerability interrupts the service, rendering the device unreachable via the PLCnext interface until a manual restart of the affected service is performed by an administrator. Because this vulnerability is accessible remotely without authentication, it presents a risk to industrial control environments where uptime is critical. Defenders should restrict network access to the PLCnext Engineer communication port to authorized management segments only.

Impact

The vulnerability results in a complete loss of service for the affected PLCnext Engineer communication interface. In an industrial or production environment, this interruption prevents operators from interacting with the PLCnext device via the client application, potentially impeding safety, monitoring, or control functions. The impact is persistent, requiring manual restart of the service, which could lead to significant operational downtime depending on the ease of physical or administrative access to the affected hardware.

Recommendation

• Implement network segmentation to restrict access to the PLCnext Engineer communication port to known, trusted engineering workstations.
• Monitor logs for repeated connection attempts or abnormal communication patterns directed at the PLCnext Engineer communication port.
• Review Phoenix Contact security advisories for official patch releases and apply them to all vulnerable PLCnext Engineer deployments.