This high-severity vulnerability in Phoenix Contact controllers allows authenticated attackers to achieve full system compromise by manipulating watchdog file operations.

The flaw is caused by improper link resolution (CWE-59) during file access, allowing a low-privileged authenticated user to perform file replacement attacks against the system watchdog process.

The ability to gain arbitrary read, write, and execute access on industrial control hardware presents a severe operational risk, potentially leading to unauthorized process manipulation, loss of control, or permanent hardware damage. With a CVSS score of 8.8, this vulnerability represents a high risk to the availability and integrity of industrial automation environments where these controllers are deployed.

Immediate Action: Update all affected Phoenix Contact devices to firmware version 2025.0.2 or later as documented in the vendor advisory.

Proactive Monitoring: Monitor system logs for unauthorized file modification attempts or unexpected behavior in the watchdog service.

Compensating Controls: Restrict network access to the management interfaces of these controllers to trusted personnel and verify that low-privileged users are not granted unnecessary file system access permissions.

Public Exploit Available: Unknown

Given the potential for total system compromise in critical industrial environments, immediate patching of the affected Phoenix Contact controllers is required. Organizations should prioritize firmware updates on all internet-exposed or remotely accessible devices to mitigate the risk of unauthorized file manipulation and potential execution of malicious code.