VYPR
High severity8.8NVD Advisory· Published May 27, 2026

CVE-2025-41669

CVE-2025-41669

Description

The Web-based Management allows a remote low privileged Engineer user to install additional APPs on the device downloaded from the PLCnext Store without implementing any data verification mechanism, leading to the capability for an Engineer user to reach arbitrary code execution with root privileges on the PLC device. A successful exploitation may allow to install a manipulated APP package, potentially impacting integrity and availability of the PLCnext Control.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A low-privileged Engineer can install unverified APPs from the PLCnext Store, leading to arbitrary code execution with root privileges on PLCnext Control devices.

Vulnerability

The Web-based Management in PLCnext firmware versions prior to 2026.0.3 allows a remote low-privileged Engineer user to install additional APPs from the PLCnext Store without any data verification mechanism, enabling the installation of manipulated APP packages [1].

Exploitation

An attacker with Engineer user credentials can access the Web-based Management, download and install a crafted APP from the store. The lack of verification allows the malicious APP to be installed, leading to arbitrary code execution with root privileges [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code with root privileges on the PLCnext Control device, compromising integrity and availability [1].

Mitigation

The vulnerability is fixed in PLCnext firmware version 2026.0.3 [1]. Users should update to this version or later to mitigate the issue.

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

1

News mentions

0

No linked articles in our index yet.