CVE-2014-9195
Phoenix Contact Software ProConOs and MultiProg Missing Authentication for Critical Function
Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffic.
Exploit likelihood
What each source reports
CVE List Score used
Phoenix Contact Software ProConOs and MultiProg Missing Authentication for Critical Function
Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffic.
- Record
CVE-2014-9195- CVSS 2.0
- 10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-306
- Updated
- 2026-11-02
EUVDEUVD-2014-9020
Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffic.
- Record
EUVD-2014-9020- CVSS 2.0
- 10.0 Critical
AV:N/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qp5x-q9h8-gxm5 No score
Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote...
Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffic.
- Record
GHSA-qp5x-q9h8-gxm5- Weakness
- CWE-306
- Updated
- 2026-11-02
NVD
Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffic.
- Record
CVE-2014-9195- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-306, CWE-255
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Phoenix Contact ILC 150 ETH PLC - Remote Control Script | 2015-05-20 |
| Metasploit | PhoenixContact PLC Remote START/STOP Command | 2015-05-20 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-9195 is a vulnerability (CVSS 10.0) in Phoenix Contact Multiprog, published January 17, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 81.1%, the 99th percentile. No source names a fixed version.