CVE-2014-9195: Phoenix Contact ProConOs and MultiProg missing authentication allows remote command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote command execution with a CVSS 2.0 score of 10 and very high EPSS, in an ICS product, makes this a critical exposure where the service is reachable.

What it is

Phoenix Contact ProConOs and MultiProg do not require authentication for critical functions, allowing remote attackers to execute arbitrary commands through protocol-compliant traffic. The flaw is a missing authentication weakness in industrial control software, and because it is reachable over the network with no credentials, it is a serious exposure for any reachable instance.

Impact

An unauthenticated remote attacker can execute arbitrary commands on the affected system, gaining full control of confidentiality, integrity and availability. In an ICS context this can mean manipulation or disruption of the controlled process.

Attack surface

The vulnerability is reached over the network via protocol-compliant traffic to the affected service; no authentication is required and no user interaction is indicated by the description or the AV:N/AC:L/Au:N vector. Any host exposing the ProConOs or MultiProg service to an untrusted network is in scope.

Exploitation

The record is not listed in CISA KEV, but EPSS is very high (0.80689, 99.6th percentile) and public exploit code exists on Exploit-DB, so exploitation is feasible and likely observed in the wild. No ransomware group association is documented.

What to do

• Apply the vendor patch or fixed firmware/software version from Phoenix Contact for ProConOs and MultiProg; this is the primary remediation.
• Isolate affected controllers and engineering workstations behind firewalls and do not expose the ProConOs/MultiProg service to untrusted networks or the internet.
• Restrict access to the service to trusted engineering hosts using allowlists and network segmentation.
• Monitor vendor and CISA ICS advisories for updated guidance and compensating controls.
• If patching is not possible, disable or block the affected service until it can be updated.

Detection

• Monitor network traffic to ProConOs/MultiProg ports for unexpected or unauthorized protocol commands from non-engineering hosts.
• Alert on connections to the affected service from outside the expected engineering subnet or from unknown source IPs.
• Review host and process logs for unexpected command execution or process creation on systems running ProConOs or MultiProg.
• Use IDS/ICS-aware signatures for known exploit traffic against these products.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.