A Critical CVE Is Not an Attack Path: Assessing PLCnext Risk in the Plant

A critical vulnerability tells you what could be exploited. It does not tell you whether an attacker can actually reach it, what conditions would be required or what the operational consequences would be inside your plant. In this episode, we examine the Phoenix Contact PLCnext advisory as a practical example of why OT vulnerability management cannot stop at CVSS. For PLCnext firmware before version 2026.0.3, CVE-2025-41769 affects the PROFINET service in its default configuration. An unauthenticated remote attacker able to reach that service could trigger a buffer overflow, potentially causing a controller reboot or arbitrary code execution. The wider advisory also covers a denial-of-service condition affecting the PLCnext Engineer interface and a lower-impact SQL injection issue. The vulnerability is clear. The plant-level exposure is not. We break down the questions that determine whether the CVE represents an urgent production risk: which controller versions are actually deployed, whether the affected service is enabled, from which network zones PROFINET is reachable, which engineering conduits cross those zones, what filtering and monitoring exist, and whether an attacker could satisfy the necessary preconditions. The episode then moves from technical exposure to operational decision-making. Should the organisation patch immediately, isolate the controller, introduce compensating controls or continue production while collecting stronger evidence? How should teams respond when asset inventories are incomplete, maintenance windows are limited and an uncontrolled intervention could create its own safety or availability risk? The Pressure Test places those decisions inside a Tier-1 automotive plant with hundreds of robotic systems, continuous production commitments and a critical vulnerability affecting controllers embedded in the manufacturing process. The central lesson is that two plants can carry the same CVE and still face completely different risks. A defensible OT vulnerability assessment must connect the advisory to the real architecture: affected asset → reachable service → attack preconditions → feasible attack path → operational consequence → detection and mitigation Cybersecurity Under Pressure explores real vulnerabilities, their operational consequences and the engineering decisions required to protect cyber-physical systems. Websitehttps://cybersecurityunderpressure.com Telegramhttps://t.me/cybersecurityunderpressure