CVE-2025-41771
Received Received - Intake

SQL Injection in Controller Web Interface Notification System

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: CERT VDE

Description
An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification functionality.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2025-41771
EUVD
EUVD-2025-210707

Affected Vendors & Products

Showing 11 associated CPEs
Vendor Product Version / Range
phoenix_contact plcnext_firmware to 2026.0.3 (exc)
phoenix_contact catan_c1 *
phoenix_contact epc_1502 *
phoenix_contact epc_1522 *
phoenix_contact axc_f_series_controllers *
phoenix_contact bpc_9102s *
phoenix_contact bpc_9202s *
phoenix_contact rfc_4072r *
phoenix_contact rfc_4072s *
phoenix_contact vl3_upc_2440_edge *
phoenix_contact vplcnext_control *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL injection vulnerability where an authenticated attacker with low privileges can access a specific endpoint in the controller's web interface. The vulnerability allows them to inject malicious SQL queries into a SQLite database that stores notification messages.

Detection Guidance

Detecting this vulnerability requires checking for SQL injection attempts in the controller's web interface endpoint handling notification messages. Monitor logs for unusual database queries or errors related to the SQLite notification database. No specific commands are provided in the context.

Impact Analysis

The impact is limited to the system's notification functionality. An attacker could potentially read, modify, or delete notification messages stored in the SQLite database. However, the database is only used for notifications, so other system data remains unaffected.

Compliance Impact

The vulnerability has limited impact on compliance with standards like GDPR or HIPAA because it only affects the system's notification functionality and does not compromise confidentiality or integrity of sensitive data. The SQL injection is restricted to a SQLite database used solely for storing notification messages, reducing exposure to compliance violations.

Mitigation Strategies

Immediately apply patches or updates from the vendor to fix the SQL injection vulnerability. Restrict access to the vulnerable endpoint to authorized users only. Review and sanitize all user inputs to prevent SQL injection in the notification functionality.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-41771. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart