An untrusted search path flaw (CWE-427) in a privileged service allows a local user with low privileges to write or replace configuration or application files in directories that the service reads. Because the service runs with elevated rights and does not protect those input locations, an attacker can alter the service’s behavior or inject malicious code, giving them the service’s privileges and full control over the device.

The affected products are Phoenix Contact PLCs and control systems: AXC F 1152, AXC F 1252, AXC F 2000 EA, AXC F 2152, AXC F 3152, BPC 9102S, EPC 1522, RFC 4072R, RFC 4072S, VL3 UPC 2440 EDGE, VPLCNEXT CONTROL 1000, 2000, 3000, and 500. No specific version ranges are listed in the CNA data.

With a CVSS score of 8.7 this issue is high severity, but the EPSS score is not available, making it unclear how frequently it is being attacked today. The vulnerability is not listed in CISA’s KEV catalog, indicating no known active exploitation. The attack requires local access to write into the vulnerable directories; no external network exploitation is described. Successful abuse would grant the attacker full system privileges on the affected device.