CVE-2020-12517

9.0 criticalEPSS 1.1%

Critical (9.0) in phoenixcontact plcnext firmware. EPSS 1.1% chance of exploitation in the next 30 days.

On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an authenticated low privileged user could embed malicious Javascript code to gain admin rights when the admin user visits the vulnerable website (local privilege escalation).

Severity

CVSS 3.1

9.0 critical

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

EPSS: 1.1% chance of exploitation in the next 30 days; higher than 66% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2020-12-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

phoenixcontact:plcnext_firmware

References

https://cert.vde.com/en-us/advisories/vde-2020-049
https://cert.vde.com/en-us/advisories/vde-2020-049

Check your stack JSON