CVE-2025-41669
| Summary |
The Web-based Management allows a remote low privileged Engineer user to install additional APPs on the device downloaded from the PLCnext Store without implementing any data verification mechanism, leading to the capability for an Engineer user to reach arbitrary code execution with root privileges on the PLC device. A successful exploitation may allow to install a manipulated APP package, potentially impacting integrity and availability of the PLCnext Control.
|
| Publication Date |
May 27, 2026, 5:16 p.m. |
| Registration Date |
May 28, 2026, 4:09 a.m. |
| Last Update |
May 27, 2026, 11:53 p.m. |
|
CVSS3.1 : HIGH
|
| スコア |
8.8
|
| Vector |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 攻撃元区分(AV) |
ネットワーク |
| 攻撃条件の複雑さ(AC) |
低 |
| 攻撃に必要な特権レベル(PR) |
低 |
| 利用者の関与(UI) |
不要 |
| 影響の想定範囲(S) |
変更なし |
| 機密性への影響(C) |
高 |
| 完全性への影響(I) |
高 |
| 可用性への影響(A) |
高 |
Related information, measures and tools
Common Vulnerabilities List