Vulnerabilities and exposures for PLCnext Control CATAN C1

The following sections list the security vulnerabilities (CVEs) that have been resolved in the respective firmware release. For more information about the specified CVE numbers, see:

Information on the Phoenix Contact PSIRT can be found at https://www.phoenixcontact.com/psirt.

Firmware releases 2026.x

2026.0.3 LTS2026.0.3 LTS

 Released on 2026-07-10

ACF

  • CVE-2025-41670

Glibc

  • CVE-2026-4438 
  • CVE-2026-4437 
  • CVE-2026-4046 

Google.golang.org/grpc

  • CVE-2026-33186

Kernel

  • CVE-2026-31431
  • CVE-2026-43037
  • CVE-2026-43038
  • CVE-2026-43284

Libcoap

  • CVE-2025-34468

Libssh

  • CVE-2025-5987 
  • CVE-2026-3731

Nghttp2

  • CVE-2026-27135

NTP

Via web-based management service any parameters for the NTP/chrony configuration could be written to the configuration file and applied accordingly.

Openssh

  • CVE-2026-35386 
  • CVE-2026-35385 
  • CVE-2026-35414 
  • CVE-2026-35387 
  • CVE-2026-35388 

Openssl

  • CVE-2026-31790 
  • CVE-2026-28390 
  • CVE-2026-28389 
  • CVE-2026-28388 
  • CVE-2026-28387 
  • CVE-2026-31789 

Python

  • CVE-2025-13837
  • CVE-2025-12084
  • CVE-2025-13836

 

 

• Published/reviewed: 2026-07-10  ☀  Revision 098 •