Phoenix Contact Software ProConOs and MultiProg Missing Authentication for Critical Function

Summary

Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffic.

Timeline

1. Jan 17, 2015, 2:00 AM UTCCVE published
2. May 20, 2015Public exploit on Exploit-DB

   EDB-37066

3. Sep 5, 2025, 9:03 PM UTCRecord last updated
4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Phoenix Contact ProConOs

  All versions

• Phoenix Contact MultiProg

  All versions

References 4