Improper privilege management in Phoenix Contact PLCnext Control Devices can enable a root reverse shell

On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use this vulnerability i.e. to open a reverse shell with root privileges.

The following Phoenix Contact products are affected in versions before 2021.0 LTS:

• AXC F 1152 (1151412).
• AXC F 2152 (2404267).
• AXC F 3152 (1069208).
• RFC 4072S, with the product identifier recorded as 1051328.
• AXC F 2152 Starterkit (1046568).
• PLCnext Technology Starterkit (1188165).

The record does not provide more granular version boundaries for individual models or release branches.

The flaw is classified as CWE-269, Improper Privilege Management, and affects Phoenix Contact PLCnext Control Devices. Successful exploitation can allow an attacker to open a reverse shell with root privileges. The record does not identify the vulnerable service, endpoint, protocol, attacker-controlled input, or implementation defect that produces the privilege outcome. The supplied scoring metadata conflicts on reachability: one source describes network access without authentication or user interaction, while another describes local access requiring low privileges. No returned technical advisory resolves that discrepancy, so the actual attack preconditions remain incompletely established.

The documented exploitation outcome is a reverse shell with root privileges on the device. One scoring record describes network reachability, low complexity, no required privileges, and no user interaction; another describes local reachability with low privileges required. Because those descriptions conflict and the record does not provide an exploit sequence, the real preconditions should be treated as uncertain. The supplied known_exploited and public_exploit fields do not confirm exploitation or a public exploit; their absence does not prove that exploitation has not occurred.

Successful exploitation can provide an attacker with a reverse shell running with root privileges on a PLCnext Control Device. That access may permit unauthorized operating-system-level actions affecting device data, configuration, services, and availability. In an industrial environment, those actions could increase the risk of operational disruption or unauthorized changes to dependent systems, but the record does not confirm a specific physical-impact scenario. The scope and prerequisites remain limited by the conflicting exploitation metadata and the absence of implementation details about the vulnerable component.

A successful compromise could provide root-level access to a controller, increasing the risk to the confidentiality, integrity, and availability of the device. Depending on the deployed environment, an attacker could potentially read system data, alter files or configuration, establish persistence, or disrupt services. The record does not confirm direct effects on control logic, physical processes, or safety functions. The specific operational impact therefore depends on the device deployment and network segmentation.

1. Phoenix Contact recommends that users of affected devices upgrade to current Firmware 2021.0 LTS or higher. The supplied solution text states that this upgrade fixes the vulnerabilities.
2. Verify the device model and installed firmware after the upgrade, and retain the result for each controller.
3. If an immediate upgrade is not possible, the supplied record does not provide a vendor-confirmed workaround. Apply only deployment-approved exposure reduction and access-control measures after assessing their effect on the control environment.
4. Recheck devices on separate branches and Starterkit deployments. Updating one device does not establish that every other model or branch has been remediated.

1. Inventory Phoenix Contact PLCnext Control Devices, including the AXC F 1152, AXC F 2152, AXC F 3152, RFC 4072S, and Starterkit products listed in the record.
2. Check the installed firmware on each device and compare it with the affected boundary in affected_summary.
3. Review firewall, network-flow, and egress telemetry for unexpected outbound connections initiated by controllers. Treat this as precautionary monitoring, not as a confirmed indicator for this vulnerability.
4. Where suitable audit telemetry exists, review unusual root-level sessions or shell activity. The record does not identify a specific event, log source, or indicator pattern.
5. Do not treat the absence of suspicious logs or connections as proof of safety, particularly because the supplied scoring metadata disagrees about the attack preconditions.