SQL injection

Summary

CVE	CVE-2025-41771
State	PUBLISHED
Assigner	CERTVDE
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-08-12 08:17:12 UTC
Updated	2026-08-12 08:17:12 UTC
Description	An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification functionality.

Risk And Classification

Primary CVSS: v4.0 5.3 MEDIUM from [email protected]

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Problem Types: CWE-89 | CWE-89 CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Version	Source	Type	Score	Severity	Vector
4.0	[email protected]	Secondary	5.3	MEDIUM	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/C...`
4.0	CNA	CVSS	5.3	MEDIUM	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N`
3.1	[email protected]	Primary	4.3	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N`
3.1	CNA	CVSS	4.3	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N`

CVSS v4.0 Breakdown

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Confidentiality

None

Integrity

Low

Availability

None

Sub Conf.

None

Sub Integrity

None

Sub Availability

None

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 Breakdown

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Phoenix Contact	AXC F 1152	affected 2019.0.4 2026.0.3 semver	Not specified
CNA	Phoenix Contact	AXC F 1252	affected 2019.0.4 2026.0.3 semver	Not specified
CNA	Phoenix Contact	AXC F 2000 EA	affected 2019.0.4 2026.0.3 semver	Not specified
CNA	Phoenix Contact	AXC F 2152	affected 2019.0.4 2026.0.3 semver	Not specified
CNA	Phoenix Contact	AXC F 3152	affected 2019.0.4 2026.0.3 semver	Not specified
CNA	Phoenix Contact	BPC 9102S	affected 2019.0.4 2026.0.3 semver	Not specified
CNA	Phoenix Contact	BPC 9202S	affected 2019.0.4 2026.0.3 semver	Not specified
CNA	Phoenix Contact	RFC 4072R	affected 2019.0.4 2026.0.3 semver	Not specified
CNA	Phoenix Contact	RFC 4072S	affected 2019.0.4 2026.0.3 semver	Not specified
CNA	Phoenix Contact	VL3 UPC 2440 EDGE	affected 2019.0.4 2026.0.3 semver	Not specified
CNA	Phoenix Contact	VPLCNEXT CONTROL 1000	affected 2019.0.4 2026.0.3 semver	Not specified
CNA	Phoenix Contact	VPLCNEXT CONTROL 2000	affected 2019.0.4 2026.0.3 semver	Not specified
CNA	Phoenix Contact	VPLCNEXT CONTROL 3000	affected 2019.0.4 2026.0.3 semver	Not specified
CNA	Phoenix Contact	VPLCNEXT CONTROL 500	affected 2019.0.4 2026.0.3 semver	Not specified
CNA	Phoenix Contact	Catan C1	affected 2019.0.4 2026.0.3 semver	Not specified
CNA	Phoenix Contact	EPC 1502	affected 2019.0.4 2026.0.3 semver	Not specified
CNA	Phoenix Contact	EPC 1522	affected 2019.0.4 2026.0.3 semver	Not specified

References

Reference	Source	Link	Tags
phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2025-056.json	[email protected]	phoenixcontact.csaf-tp.certvde.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

Vendor Comments And Credit

Discovery Credit

CNA: CyberDanube (en)

There are currently no legacy QID mappings associated with this CVE.