Threat Overview & Industrial Exposure
Phoenix Contact has published an emergency security notice in coordination with the German CERT@VDE and CISA ICS-CERT detailing a critical vulnerability (CVE-2026-78950, CVSS 9.5) impacting its Inline Modular Controllers (ILC Series). These compact PLCs are widely deployed in industrial automation across renewable energy wind farms, water distribution booster stations, automated conveyor logistics, and machine tool fabrication lines.
The flaw enables an unauthenticated attacker located on the local plant Ethernet network to send crafted PROFINET IO packets to the controller, overflowing an internal static memory buffer and gaining arbitrary code execution within the real-time operating system (RTOS) kernel.
Protocol Root Cause: PROFINET Acyclic Data Record Overflow (CWE-121)
PROFINET IO utilizes standard Ethernet (Layer 2) and UDP/IP (Layer 4) channels to coordinate high-speed cyclical I/O data exchange alongside acyclic parameterization and diagnostic services. The vulnerability is situated within the PROFINET Acyclic Read/Write Record Handler listening on UDP port 34964.
When processing PROFINET Write Multiple Records requests, the controller's protocol engine calculates buffer length using an unvalidated 16-bit unsigned integer supplied by the client. An attacker can craft a frame containing mismatched length headers that overwrites the call stack return address, hijacking the instruction pointer on the controller's ARM processor:
| Controller Family | Affected Hardware & Firmware | Remediated Firmware |
|---|---|---|
| ILC 131 ETH / ILC 151 ETH | Firmware versions prior to 4.92 | Upgrade to v4.92 or later |
| ILC 171 ETH 2TX / ILC 191 ETH 2TX | Firmware versions prior to 4.90 | Upgrade to v4.90 or later |
| ILC 2050 GHG (Building Automation) | Firmware versions prior to 3.22 | Upgrade to v3.22 or later |
Operational Impact: Uncontrolled Actuation & Physical Process Interruption
By achieving code execution inside the PLC kernel, an adversary can directly manipulate digital and analog I/O bus terminals. For example, in an industrial water treatment or pumping facility, the attacker could force booster pump output relays into continuous operation while suppressing pressure alarm telemetry sent to SCADA screens, risking pipe ruptures and localized equipment burnout.
IEC 62443 Defense-in-Depth Directives
Asset owners and plant engineers must implement the following protective measures in compliance with IEC 62443-3-3 (System Security Requirements):
- Firmware Flash Update: Upgrade in-scope ILC controllers to patched firmware builds via the Phoenix Contact AutomationXplorer tool.
- Filter PROFINET UDP Ports: Block UDP port 34964 and PROFINET EtherType (
0x8892) at all perimeter firewalls, ensuring PROFINET traffic cannot cross beyond Level 1/Level 2 boundaries. - Enforce Zones & Conduits (IEC 62443-3-2): Isolate field controllers from corporate office networks and prevent direct Internet connectivity to industrial Ethernet ports under all operating conditions.
