Vulnerabilities Allow Disruption of Phoenix Contact UPS Devices

Phoenix Contact has released patches for several vulnerabilities in its QUINT4 uninterruptible power supply (UPS) devices, addressing flaws that could enable remote, unauthenticated attackers to perform denial-of-service (DoS) attacks or steal login credentials. Four of the flaws, CVE-2025-41703, CVE-2025-41704, CVE-2025-41706 and CVE-2025-41707, can be exploited to trigger DoS conditions, with CVE-2025-41703 in particular allowing an unauthenticated attacker to use a Modbus command to turn off the UPS output.

According to CyberDanube, whose researchers notified Phoenix Contact, these vulnerabilities can place devices into a permanent DoS state and prevent remote recovery; CVE-2025-41705 is described as a password information leakage issue that could allow an unauthenticated attacker in a MitM position to intercept Webfrontend passwords.

Phoenix Contact’s advisory states that the flaws affect several QUINT4-UPS EtherNet/IP models and have been patched with firmware version VC:07, except for CVE-2025-41703, which cannot be addressed without disrupting legitimate functionality. As a mitigation, the company recommends isolating affected devices in industrial networks and protecting them with a firewall, noting that CyberDanube has not found internet-exposed UPS devices.