Advisories

For CVSS 2.0, 3.0 and 3.2
VDE-2025-059
July 21, 2025, 12:00 PM

Helmholz: Multiple vulnerabilities in REX 100

Multiple vulnerabilities in all REX 100 devices with firmware <= 2.3.2 that allow an attacker to gain full control over the device.
CVE-2025-41675
CVE-2025-41674
CVE-2025-41673
CVE-2025-41678
CVE-2025-41679
CVE-2025-41677
CVE-2025-41676
CVE-2025-41681
VDE-2025-053
July 8, 2025, 12:00 PM

Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware

Multiple Linux component vulnerabilities fixed in latest PLCnext Firmware release 2025.0.2
CVE-2024-12084
CVE-2024-10918
CVE-2024-52533
CVE-2025-0665
CVE-2024-38428
CVE-2024-5594
CVE-2024-5535
CVE-2024-6345
CVE-2025-24965
CVE-2024-9341
CVE-2018-1000035
CVE-2024-9287
CVE-2018-20969
CVE-2018-1000156
CVE-2019-13638
CVE-2024-12085
CVE-2024-6232
CVE-2018-6952
CVE-2018-6951
CVE-2024-6119
CVE-2024-25062
CVE-2025-27113
CVE-2024-8176
CVE-2024-12705
CVE-2025-26465
CVE-2024-10524
CVE-2024-12088
CVE-2024-12087
CVE-2024-9681
CVE-2024-12086
CVE-2019-13636
CVE-2025-26466
CVE-2024-50602
CVE-2024-12747
CVE-2018-18384
CVE-2022-0529
CVE-2022-0530
CVE-2019-20633
CVE-2024-0684
CVE-2023-27043
CVE-2024-12133
CVE-2020-16120
CVE-2024-5742
CVE-2024-8006
CVE-2023-7256
CVE-2024-28882
CVE-2024-9143
CVE-2016-9844
CVE-2024-11053
CVE-2025-0167
CVE-2019-13232
CVE-2021-4217
CVE-2015-7697
CVE-2015-7696
VDE-2025-014
July 8, 2025, 12:00 PM

Phoenix Contact: Security Advisory for CHARX SEC-3xxx charging controllers

Multiple vulnerabilities in the firmware of CHARX SEC-3xxx charging controllers have been discovered.
CVE-2025-24003
CVE-2025-24006
CVE-2025-24005
CVE-2025-24002
CVE-2025-24004
VDE-2025-019
July 22, 2025, 10:00 AM

Phoenix Contact: Security Advisory for CHARX SEC-3xxx charging controllers

Multiple vulnerabilities in the firmware of CHARX SEC-3xxx charging controllers have been discovered. **Update Version 1.1.0:** Updated the reporting credits for CVE-2025-25271.
CVE-2025-25270
CVE-2025-25271
CVE-2025-25268
CVE-2025-25269
VDE-2025-054
July 8, 2025, 12:00 PM

Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware

Multiple vulnerabilities in the PLCnext system allowed low-privileged remote attackers to gain unauthorized access or trigger system reboots by manipulating configuration files and symbolic links. Affected services include watchdog, arp-preinit, …
CVE-2025-41668
CVE-2025-41667
CVE-2025-41666
CVE-2025-41665
VDE-2025-030
July 29, 2025, 12:00 PM

Frauscher: FDS101, FDS-SNMP101 and FDS102 for FAdC/FAdCi are Vulnerable to OS Command Injection Vulnerability

Frauscher Sensortechnik FDS101, FDS-SNMP101 and FDS102 for FAdC/FAdCi R2 and all previous versions are vulnerable to OS Command Injection via malicious configuration file. CVE-2025-3626 affects FDS102 versions v2.8.0 < v2.13.3. …
CVE-2025-3626
CVE-2025-3705
VDE-2025-045
July 1, 2025, 12:00 PM

Pilz: Missing Authentication in Node-RED integration

Authentication is not configured by default for the Node-RED server on the Pilz industrial PC IndustrialPI. An unauthenticated remote attacker has full access to the Node-RED server and can run …
CVE-2025-41656
VDE-2025-039
July 1, 2025, 12:00 PM

Pilz: Authentication Bypass in IndustrialPI Webstatus

The Pilz industrial PC IndustrialPI webstatus application is vulnerable to an authentication bypass.
CVE-2025-41648