Vulnerabilities Allow Disruption of Phoenix Contact UPS Devices

Phoenix Contact this week announced patches for several vulnerabilities affecting its QUINT4 uninterruptible power supply (UPS) products. 

The vendor has fixed five vulnerabilities that can be exploited by remote, unauthenticated attackers for denial-of-service (DoS) attacks and to obtain login credentials.

Four of the vulnerabilities, tracked as CVE-2025-41703, CVE-2025-41704, CVE-2025-41706 and CVE-2025-41707, can be exploited for DoS attacks.

According to IT/OT cybersecurity firm CyberDanube, whose researchers reported the flaws to Phoenix Contact, an attacker can exploit these vulnerabilities to put devices in a permanent DoS condition, preventing remote recovery.

CVE-2025-41703 is interesting as it allows an unauthenticated attacker to use a Modbus command to turn off the output of a UPS device.

CyberDanube told SecurityWeek that CVE-2025-41703 can be described as a ‘dangerous function exploitation’ that leads to a so-called ‘denial of power service’.

Another flaw, CVE-2025-41705, has been described as a password information leakage issue that can allow an ...