Phoenix Contact SBOM: getting PLCnext, Axioline modules and IO-Link into the device list

What hangs on a PLCnext controller and what of it is visible on the network

The controller is a PLCnext Control or an ILC/RFC, with Axioline F modules directly on the local bus. Further Axioline stations hang on PROFINET via bus couplers (AXL F BK PN), IO-Link sensors via masters (IOL MA8 PN), plus FL SWITCH, FL MGUARD and TC ROUTER on the network. Phoenix Contact is the most PROFINET-friendly world in this series: almost everything with its own IP is PI-certified and provides I&M0.

• Visible via IP from the maintenance PC: PLCnext Control, bus couplers, IO-Link masters and PROFINET switches via DCP and I&M0 (OrderID = article number, serial number, hardware and firmware version); FL SWITCH and FL MGUARD via SNMP (sysObjectID under IANA 4346); PLCnext additionally via OPC UA.
• Visible as submodules of the head: Axioline F modules behind a PROFINET bus coupler. The coupler reports them per slot and subslot, and every module with firmware carries its own I&M0 record with article number there.
• Only via the controller or the master: Axioline modules on the local bus of a PLCnext Control and IO-Link sensors behind a master. Their article number and firmware are shown by the controller's Web-Based Management, PLCnext Engineer online or the IO-Link interface of the master.

How Axioline modules and IO-Link devices get into the list: I&M0 per slot, PLCnext Engineer, IO-Link master

Behind a PROFINET coupler the scan is enough: I&M0 per slot provides the modules with article number and firmware. On the local bus of a PLCnext Control, Web-Based Management and PLCnext Engineer online show the module list; IO-Link devices are provided by the master as PROFINET submodules or via its JSON interface with VendorID, DeviceID and product name. From the network, the following are added:

• PLCnext Engineer (PLCnext Control) or PC Worx / Automation Worx (classic ILC/RFC): hardware configuration with article number per module.
• PROFINET DCP and I&M0: PLCnext Control, Axioline F couplers, IO-Link master IOL MA8 PN and FL SWITCH devices with PROFINET profile return OrderID (= article number), serial number, hardware and firmware version – the most stable route at Phoenix Contact.
• SNMP on PLCnext, FL SWITCH and FL MGUARD (sysObjectID under IANA number 4346), OPC UA on PLCnext Control. Background in the article on the network scan.

How Phoenix Contact publishes advisories and what matching runs on

The PSIRT page keeps an archive with VDE IDs and a PGP key; there is no provider of its own under phoenixcontact.com (.well-known/csaf answers with 403). The CERT@VDE provider delivers ROLIE feed, index.txt and changes.csv. Phoenix Contact is not listed in the BSI aggregator, although the provider permits mirroring.

Example VDE-2026-027: "IOL MA8 PN DI8" with model_numbers: ["1072838"]. Example VDE-2025-056: "AXC F 2152" with 1151412, plus hardware CPE cpe:2.3:h:phoenix_contact:axc_f_1152 and the relationship "Firmware <2026.0.3 installed on AXC F 2152". 86 of the 113 documents carry an update stamp from 2025 – an archive catch-up in one burst.

90 of 113 documents carry model_numbers, only six a CPE. The reliable key is the article number, as it also appears on the type plate and in the I&M0 record, combined with the firmware range (>=1.0.0 | <1.7.4). One peculiarity: since 2024 Phoenix writes the PLCnext firmware as a year version ("2026.0.3"); older devices run "2023.0 LTS" – the device list has to be able to compare both notations.

Anyone pulling the device list from the EPLAN parts list has the article number but not the firmware version. Anyone who only scans has both, but not the assignment to the plant section. Both together is the normal case, described in the article on creating an SBOM for plant builders.

Phoenix Contact has announced SBOMs ‘on our website’, we did not find a download location; for the plant you do not need one.

What this means for installations with Phoenix components

• Record article number and firmware per PLCnext controller, coupler, switch, router and IO-Link master – directly from the network via I&M0.
• Do not forget FL MGUARD and TC ROUTER as network and security components: 2026 brought advisories for both, and they are missing from many control projects.

The article number is in the EPLAN bill of materials, the firmware version only on the device, and routers, switches and IO-Link masters are missing from most controller projects. In Werkspilot Scan, Phoenix Contact is stage 1: the run from the maintenance PC covers controller, couplers, switches, routers and the Axioline modules behind PROFINET couplers via I&M0 and SNMP; IO-Link sensors behind the master follow in stage 3. We are currently trialling the third stage with development partners on their plants.