Summary
This advisory addresses security vulnerabilities in Phoenix Contact products with an integrated CodeMeter Runtime, like PLCnext devices and Virtual Controls. These security vulnerabilities only may occur with versions <8.41a of the integrated software CodeMeter Runtime from Wibu-Systems. Please see listed products to determine which devices and firmware versions are affected.
Impact
The reported vulnerabilities allow unauthenticated attackers to read and overwrite sensitive configuration data and to crash CodeMeter Runtime which has only an impact on the licensing infrastructure. Licenses then are not accessible anymore. These security vulnerabilities may occur on PLCnext devices or Virtual Controls with an integrated CodeMeter Runtime (see affected products).
Affected Product(s)
| Model no. | Product name | Affected versions |
|---|---|---|
| 1151412 | AXC F 1152 | Firmware 2025.0 <2026.0.6 |
| 1646469 | AXC F 1252 | Firmware 2025.0 <2026.0.6 |
| 1551772 | AXC F 2000 EA | Firmware 2025.0 <2026.0.6 |
| 2404267 | AXC F 2152 | Firmware 2025.0 <2026.0.6 |
| 1069208 | AXC F 3152 | Firmware 2025.0 <2026.0.6 |
| 1246285 | BPC 9102S | Firmware 2025.0 <2026.0.6 |
| 1839159 | BPC 9202S | Firmware 2025.0 <2026.0.6 |
| 1886438 | Catan C1 | Firmware 2025.0 <2026.0.6 |
| 1136419 | RFC 4072R | Firmware 2025.0 <2026.0.6 |
| 1051328 | RFC 4072S | Firmware 2025.0 <2026.0.6 |
| 1760157 | VL3 UPC 2440 EDGE | Firmware 2025.0 <2026.0.6 |
| 1737875 | VPLCNEXT CONTROL 1000 | Firmware 2025.0 <2026.0.6 |
| 1738453 | VPLCNEXT CONTROL 2000 | Firmware 2025.0 <2026.0.6 |
| 1738454 | VPLCNEXT CONTROL 3000 | Firmware 2025.0 <2026.0.6 |
| 1751491 | VPLCNEXT CONTROL 500 | Firmware 2025.0 <2026.0.6 |
| CodeMeter Runtime | vers:generic/>=8.0|<8.41a |
Vulnerabilities
Expand / Collapse allIf CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions. Commands intended only for local or same-network clients can therefore be executed by arbitrary remote peers. An attacker can read potentially sensitive configuration data and overwrite selected values in Server.ini. This does include the hash of the credentials for the CodeMeter WebAdmin, enabling WebAdmin takeover.
In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format specifiers. This can be used to reliably crash CodeMeter and disclose sensitive information such as process memory and stack canaries. The attack works locally, for example by using cmu --set-proxy to set the proxy value, and remotely when combined with CVE-2026-81573 by setting General.ProxyServer and then triggering this vulnerability.
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak SID as sole authenticator. An attacker can brute-force the SID, recover another session's handle number, and read license information belonging to another handle.
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data length and the data itself. Missing bounds checking on the data length value can lead to out of bounds reads, causing a segmentation fault that ultimately crashes the CodeMeter Runtime.
Mitigation
For affected PLCnext devices and Virtual Controls with an integrated Codemeter Runtime (see affected products), PHOENIX CONTACT strongly recommends to follow the descriptions below:
On PLCnext devices switch on the firewall via the WBM to avoid an unauthenticated access.
Remediation
Please check the Phoenix Contact e-Shop regularly to see if the fixed firmware is already available for your specific PLCnext device or Virtual PLCnext Control. The Fix is planned to be integrated in version 2026.0.6 which is planned for Q4/2026.
Acknowledgments
Phoenix Contact GmbH & Co. KG thanks the following parties for their efforts:
- CERT@VDE for coordination. (see https://certvde.com )
- Wibu-Systems for Reporting. (see https://www.wibu.com/support/security-advisories.html )
- Vector Informatik GmbH Andrew Teylu for Reporting.
Revision History
| Version | Date | Summary |
|---|---|---|
| 1.0.0 | 04.11.2026 12:00 | Initial |