CVE-2020-12499— PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and earlier: Improper path sanitation vulnerability.
Quick assessment
Affected
PHOENIX CONTACT PLCnext Engineer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Phoenix Contact PLCnext Engineer是德国菲尼克斯电气（Phoenix Contact）公司的一套用于自动化控制器的工程软件平台。 PHOENIX CONTACT PLCnext Engineer 2020.3.1及之前版本中存在路径遍历漏洞，该漏洞源于导入项目文件时未正确清理路径。攻击者可通过诱使用户打开特制文件利用该漏洞在系统上执行任意代码。
Possible ATT&CK Techniques 2 AI
T1189 · Drive-by Compromise T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2020-12499
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and earlier: Improper path sanitation vulnerability.
Source: CVE Program / CVE List V5
Vulnerability Description
In PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and earlier an improper path sanitation vulnerability exists on import of project files.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
Phoenix Contact PLCnext Engineer 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Phoenix Contact PLCnext Engineer是德国菲尼克斯电气（Phoenix Contact）公司的一套用于自动化控制器的工程软件平台。 PHOENIX CONTACT PLCnext Engineer 2020.3.1及之前版本中存在路径遍历漏洞，该漏洞源于导入项目文件时未正确清理路径。攻击者可通过诱使用户打开特制文件利用该漏洞在系统上执行任意代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| PHOENIX CONTACT | PLCnext Engineer | unspecified ~ 2020.3.1 | - |
|
II. Public POCs for CVE-2020-12499
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-12499
请登录查看更多情报信息。
Other References for CVE-2020-12499 (1)
-
https://cert.vde.com/en-us/advisories/vde-2020-025 x_refsource_MISC
IV. Related Vulnerabilities
Same weakness: CWE-22
-
CVE-2026-81491
boxpositron with-context-mcp index.ts project_folder path tr -
CVE-2026-81486
bsmi021 mcp-file-context-server Path Resolution index.ts rea -
CVE-2026-81485
danielpopamd linkedin-ads-mcp Media Upload campaign-manageme -
CVE-2026-61792
Weblate path traversal allows a project administrator to rea -
CVE-2026-63179
Winter: Local File Inclusion through @import directives in L
V. Comments for CVE-2020-12499
No comments yet