Malicious logic execution via bypassed integrity checks

Incorrect permission assignment in Phoenix Contact PLCnext products through 2024.0 allows remote authenticated users to upload malicious logic. The application integrity check accepts specially crafted logic files, executable logic, or configurations without recognizing their tampering. Exploitation requires authenticated network or physical access to an engineering station, stored application, transfer path, or controller, and grants control of PLC logic and runtime data.