CVE-2018-25112 json
PHOENIX CONTACT: ILC 1x1 ETH Denial of Service
published 2025-06-04 17 mo ago modified 2026-06-17 4 mo ago also EUVD-2018-21599
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 41%
- public exploits
- 0
- none known
Summary
An unauthenticated remote attacker may use an uncontrolled resource consumption in the IEC 61131 program of the affected products by creating large amounts of network traffic that needs to be handled by the ILC. This results in a Denial-of-Service of the device.
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 17 mo ago
Exploit prediction
0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
- PHOENIX CONTACT ILC 131
- PHOENIX CONTACT ILC 151
- PHOENIX CONTACT ILC 171
- PHOENIX CONTACT ILC 191 ETH
Classification
- Weakness
-
- CWE-770 Allocation of Resources Without Limits or Throttling
References
-
certvde.com
/en/advisories/VDE-2018-012/
vendor-advisory
Sources
- CVE List CVE-2018-25112
- NVD CVE-2018-25112
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.