CVE-2025-41669

The record

The Web-based Management allows a remote low privileged Engineer user to install additional APPs on the device downloaded from the PLCnext Store without implementing any data verification mechanism, leading to the capability for an Engineer user to reach arbitrary code execution with root privileges on the PLC device. A successful exploitation may allow to install a manipulated APP package, potentially impacting integrity and availability of the PLCnext Control.

Affected packages

Related vulnerabilities

• CVE-2026-63182 LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization… CWE-347
• CVE-2026-46560 Open Access Management (OpenAM) is an access management solution. CWE-347
• CVE-2026-119037 Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a… CWE-347
• CVE-2026-119561 phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in… CWE-347
• CVE-2026-118559 Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe… CWE-347
• CVE-2026-118774 Forge (also called node-forge) is a native implementation of Transport Layer Security in… CWE-347
• CVE-2026-118768 Botan is a C++ cryptography library. CWE-347
• CVE-2026-88078 Improper verification of cryptographic signature in Microsoft Edge (Chromium-based)… CWE-347