CVE-2025-41703 HIGH

CVE-2025-41703: Phoenix Contact: UPS Shutdown via Unauthenticated Modbus Command

Vendor Phoenix Contact
Product QUINT4-UPS/24DC/24DC/5/EIP
Weakness CWE-306 · Missing auth
Published October 14, 2025
Last update November 3, 2025
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

An unauthenticated remote attacker can cause a Denial of Service by turning off the output of the UPS via Modbus command.

Key dates

02Disclosure timeline

October 14, 2025 CVE published
November 3, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-11848 IEI Integration Corp｜ iRM-IEI Remote Management - Missing Authentication CVE-2026-25550 Seagull Software BarTender Unauthenticated RCE via .NET Remoting Service CVE-2026-56782 Gorse - Unauthenticated Database Dump and Restore via /api/dump and /api/restore Endpoints CVE-2023-54350 WordPress Augmented-Reality Plugin Remote Code Execution Unauthenticated CVE-2026-58446 Presenton < 0.8.8-beta - Authentication Bypass of Session Auth via Unprotected MCP Endpoint