Summary Points
- Phoenix Contact released patches for five vulnerabilities in its QUINT4 UPS products, primarily enabling remote DoS attacks and credential theft.
- Four vulnerabilities (CVE-2025-41703, CVE-2025-41704, CVE-2025-41706, CVE-2025-41707) can cause permanent DoS, with CVE-2025-41703 allowing an attacker to turn off UPS output via Modbus commands.
- A significant flaw, CVE-2025-41705, risks password leakage through Webfrontend interception when an attacker is positioned between the user and device.
- Firmware updates (except for CVE-2025-41703) address many of these issues, and Phoenix recommends isolating affected devices within industrial networks protected by firewalls to prevent exploitation.
The Core Issue
This week, Phoenix Contact revealed they have issued patches to fix several serious security flaws in their QUINT4 uninterruptible power supply (UPS) units. These vulnerabilities, identified as CVE-2025-41703, CVE-2025-41704, CVE-2025-41706, and CVE-2025-41707, can be exploited remotely without prior authentication, enabling attackers to launch denial-of-service (DoS) attacks that could permanently disable the devices, or even steal login credentials. Cybersecurity researchers from CyberDanube discovered these vulnerabilities and reported them to Phoenix Contact, warning that malicious actors could exploit them to disrupt power systems — particularly if the devices are connected to the internet. Notably, CVE-2025-41703 allows hackers to remotely turn off the UPS output via a Modbus command, causing a ‘denial of power service,’ while another flaw, CVE-2025-41705, could let attackers intercept sensitive password data over the web.
Phoenix Contact responded by releasing firmware updates for the affected hardware, but they could not fix CVE-2025-41703 because doing so might interfere with the device’s intended functions. The company strongly recommends isolating these products within secure, offline industrial networks and deploying firewalls to prevent online access. CyberDanube, who provided the initial findings, confirmed that most of these UPS devices are not exposed directly to the internet, meaning that an attacker would first need network access before exploiting the vulnerabilities. Overall, this incident highlights the ongoing risks associated with connected industrial equipment and underscores the importance of robust network security measures to prevent cyberattacks that could compromise critical power infrastructure.
Potential Risks
Phoenix Contact recently issued patches for multiple vulnerabilities affecting its QUINT4 UPS units, which could be exploited remotely by unauthenticated attackers to cause denial-of-service (DoS) conditions or steal login credentials. Four identified flaws (CVE-2025-41703, CVE-2025-41704, CVE-2025-41706, CVE-2025-41707) can disable devices permanently or crash them, with CVE-2025-41703 notably allowing an attacker to turn off the UPS output via a Modbus command—potentially leading to power outages. Another flaw, CVE-2025-41705, risks leaking Webfrontend passwords through man-in-the-middle interception. While the vulnerabilities mainly affect isolated, industrial networks and have been patched via firmware updates (except CVE-2025-41703, which remains unpatched due to potential functionality disruption), they highlight the importance of network segmentation, firewalls, and cautious exposure controls. If these devices are connected to the internet, the threat escalates, offering attackers direct web-based attack vectors, underscoring the critical need for robust cybersecurity measures in industrial environments.
Possible Actions
Addressing vulnerabilities in Phoenix Contact UPS devices swiftly is critical to prevent significant operational disruptions, protect data integrity, and ensure continuous power supply in sensitive environments. Delays in remediation can lead to exploitation, extensive downtime, and financial loss.
Mitigation Measures:
- Firmware Updates: Regularly install the latest security patches provided by Phoenix Contact to fix known vulnerabilities.
- Network Segmentation: Isolate UPS management interfaces from other networks to reduce exposure to cyber threats.
- Access Controls: Implement strict authentication and authorization protocols to restrict unauthorized device access.
- Monitoring: Deploy continuous monitoring for unusual activity or attempted breaches on UPS systems.
- Vendor Support: Maintain communication with Phoenix Contact for security advisories and recommended best practices.
- Configuration Review: Periodically audit device settings to ensure secure configurations are maintained.
- Incident Response: Prepare and rehearse a response plan for potential security breaches or system failures related to vulnerabilities.
Advance Your Cyber Knowledge
Discover cutting-edge developments in Emerging Tech and industry Insights.
Access world-class cyber research and guidance from IEEE.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1
