ZeroDay Findings
Sign inSign up

Findings

CVE-2014-9195

Phoenix Contact Software ProConOs and MultiProg Missing Authentication for Critical Function

Published Jan 17, 2015 · corrected/updated Sep 5, 2025 · Phoenix Contact ProConOs · evidence confidence high

Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffic.

Grounded briefings

Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.

Executive

CVE-2014-9195 is a critical public vulnerability record for Phoenix Contact ProConOs. It is not currently listed in the CISA Known Exploited catalog. Check the linked vendor or CERT advisories for patch status. This summary is a catalog interpretation of the ingested metadata and cites the original advisories below.

System administrator

Identify whether Phoenix Contact ProConOs is in your estate, then compare installed versions with the affected ranges. Affected packages or ranges on record: Phoenix Contact MultiProg; Phoenix Contact ProConOs. Check the linked vendor or CERT advisories for patch status. Prefer the vendor or distribution advisory linked in Sources before changing production systems. This is a catalog interpretation, not a runbook.

Security analyst

Signals on file: CVSS 10.0, EPSS 80.7%. It is not currently listed in the CISA Known Exploited catalog. Weakness classes: CWE-306. Sources contributing to this record: cisa_advisories, cisa_ics, cve_org, epss. Public exploit references, when present, are outbound links only and are not proof of active exploitation. This is a catalog interpretation of stored metadata.

Exploitation and remediation

  • Exploitation evidence

    Not listed as known exploited in CISA KEV. Not in the CISA KEV catalog.

  • Patch and remediation

    No required-action text is stored yet. Use the vendor or CERT links in Sources for patch availability.

  • Safe detection guidance

    Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 5, 2025 · CVE.org

    Updated

    Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffic.

  2. Oct 6, 2026 · CISA Cybersecurity Advisories

    Detected

    View CSAF Summary Hitachi Energy is publishing this cybersecurity advisory in response to the security findings reported by Dragos affecting end-of-life RTU500 CMU firmware version 9.x. The reported findings are associated with legacy RTU500 firmware versions that were developed according to the cybersecurity requirements, threat landscape, and industry practices that existed at the time of their

Affected

  • vendor Phoenix Contact MultiProgversion unspecified
  • vendor Phoenix Contact ProConOsversion unspecified

Sources

  • CISA Cybersecurity AdvisoriesGovernment advisoryCVE-2014-9195

    View CSAF Summary Hitachi Energy is publishing this cybersecurity advisory in response to the security findings reported by Dragos affecting end-of-life RTU500 CMU firmware version 9.x. The reported findings are associated with legacy RTU500 firmware versions that were developed

    cisa.gov
  • CISA ICS AdvisoriesGovernment advisoryCVE-2014-9195

    View CSAF Summary Hitachi Energy is publishing this cybersecurity advisory in response to the security findings reported by Dragos affecting end-of-life RTU500 CMU firmware version 9.x. The reported findings are associated with legacy RTU500 firmware versions that were developed

    cisa.gov
  • CVE.orgVulnerability recordCVE-2014-9195

    Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffic.

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2014-9195

    30-day exploitation probability 80.7%

    first.org
  • Metasploit ModulesPublic exploit moduleauxiliary_admin/scada/phoenix_command

    Public module reference (normal). Module source is not copied into this catalog.

    rapid7.com

References