RWP Ventures RWP VenturesIntelligence

Historical intelligence backfill. This assessment covers reporting originally published on 2026-05-29 and was added to the RWP archive on 2026-09-07.

Daily Top · OT

PLCnext "Engineer" was one store-app install away from root

Nozomi, 29 May 2026 — Phoenix Contact AXC F 3152 firmware 2024.0.6, CVE-2025-41669 (CVSS 8.8). Low-priv Engineer tampers a legitimate PLCnext Store app; the runtime runs it as root. Vendor says multiple models.

RWP Ventures · 2026-09-07 · event 2026-05-29 · 1 min read · priority 8.1

Bottom line up front

CONFIRMED 29 May 2026 Nozomi Labs — Phoenix Contact PLCnext AXC F 3152 on firmware 2024.0.6. Several web-interface issues; the one that matters is CVE-2025-41669, CVSS 8.8, CWE-349 (improper verification of cryptographic signature). An Engineer-role user, not an administrator, can manipulate a legitimate application from the PLCnext Store so the device installs and executes it as root. Vendor: multiple PLCnext models, not one SKU. Industrial Cyber summarized 2 June. This is authenticated, role-abuse, on-device trust failure — not a pre-auth internet worm. Process impact if root is achieved on a controller that is actually driving plant: ASSESSED as possible; CONFIRMED exploitation in the wild at publication: not claimed.

Historical backfill of 29 May 2026 reporting; added 7 September 2026.

What happened

Labs walked Engineer → store app tamper → root. Signature check on the app package did not bind the content the runtime then executed with high privilege.

Why it mattered

"Engineer" is the role you give the contractor. If that role is root, your RBAC slide is fiction.

Who / what was affected

PLCnext family per Phoenix Contact's scope statement. Plants that expose the web UI to the engineering VLAN — or worse, beyond it.

Technical context

Patch firmware. Disable store installs where policy allows. Do not leave Engineer accounts on internet-facing PLCs (they should not be internet-facing at all).

Exploitation / threat status at the time

CONFIRMED vuln + vendor-affected models.

UNKNOWN in-the-wild.

What defenders should have done

  1. Firmware to the fixed train Phoenix Contact named.
  2. Inventory Engineer and Admin accounts.
  3. Block PLCnext Store from production controllers if not required.

RWP assessment

Confidence: High on the CVE and the role-to-root story.

Defensive actions

  1. Treat engineering roles as admin-equivalent until patched.
  2. Network-restrict the web UI.
  3. Same-week read: CODESYS Service-to-root chain — different vendor, same lesson.

Sources

  1. Nozomi Networks — Breaking the trust boundary — PLCnext privilege escalation
  2. Industrial Cyber — Privilege-escalation flaws in Phoenix Contact PLCnext
  3. Phoenix Contact / CVE-2025-41669 — Improper verification of cryptographic signature (CWE-349)

Related intelligence