Phoenix Contact — 3 prefixes (MA-L)

Phoenix Contact holds three MA-L (24-bit OUI) blocks in the IEEE registry — 00:A0:45, A8:74:1D, and CC:CC:EA — registered to "Phoenix Contact GmbH & Co. KG." Web sources identify the in-house electronics manufacturing subsidiary, Phoenix Contact Electronics GmbH (established 1996 in Bad Pyrmont, Lower Saxony), as the operating entity behind the OUIs; the parent holding company traces to 1923 (founded in Essen by Hugo Knümann) and is headquartered today in Blomberg, North Rhine-Westphalia. The two newer blocks carry the Bad Pyrmont registry address (Dringenauer Str. 30, D-31812); the legacy 00:A0:45 block lists Postfach 1341, Lower Saxony, D-31812. A Phoenix Contact MAC almost always belongs to industrial networking or automation hardware rather than any consumer device: FL SWITCH industrial Ethernet switches (unmanaged 1000/1100, managed 2000, TSN-capable 2300/5900), industrial routers and 4G/LTE gateways, WLAN access points, and PLCnext / AXC F series controllers, speaking PROFINET, EtherNet/IP, Modbus, PROFIBUS, DeviceNet, CANopen, and INTERBUS. Seeing one on a network is a strong signal of an ICS/OT environment — a managed switch, router, wireless AP, or PLC on a plant floor, in process automation, or in energy/infrastructure deployments. That OT context matters for security: Phoenix Contact products have a documented CVE history tracked across multiple CISA ICS advisories (2016–2024), including critical FL SWITCH command-execution and buffer-overflow flaws and PLCnext key-management issues, so these devices should be treated as sensitive OT nodes (network isolation, current firmware, and access control are the recommended mitigations). As with all OUIs, no registration date is published by IEEE; the "1998-04-22 / 2015-11-17 / 2023-07-19" dates seen on third-party MAC databases are database artifacts, not IEEE facts.

IEEE assignment

3 prefixes → Phoenix Contact GmbH & Co. KG, registered Bad Pyrmont / Lower Saxony, DE [Confirmed] — IEEE MA-L (https://standards-oui.ieee.org/oui/oui.csv)

Registry / block size

MA-L (24-bit OUI), all three assignments; each block covers ~16.7M addresses [Confirmed] — IEEE oui.csv. No MA-M (mam.csv) or MA-S (oui36.csv) assignment exists. NOTE: IEEE's public OUI data publishes NO assignment/registration date (columns are only Registry, Assignment, Organization Name, Organization Address); any "date registered" on third-party tools is a database artifact, not an IEEE fact.

HQ / country

registry addresses Dringenauer Str. 30, Bad Pyrmont, D-31812 (A8:74:1D, CC:CC:EA) and Postfach 1341, Lower Saxony, D-31812 (00:A0:45), Germany [Confirmed] — IEEE MA-L. Parent corporate HQ: Blomberg, North Rhine-Westphalia, DE [Confirmed] — en.wikipedia.org/wiki/Phoenix_Contact

Registered entity

OUI holder is Phoenix Contact Electronics GmbH (electronics manufacturing subsidiary, established 1996, Bad Pyrmont); parent holding is Phoenix Contact GmbH & Co. KG [Confirmed] — en.wikipedia.org/wiki/Phoenix_Contact, maclookup.app/vendors/phoenix-contact-electronics-gmbh

Company status

active; private family-owned [Confirmed] — phoenixcontact.com

Company history / size

founded 1923 (Essen, by Hugo Knümann; relocated to Blomberg post-WWII); ~20,300 employees and ~€2.97B revenue (2021); ~50 international subsidiaries [Confirmed] — en.wikipedia.org/wiki/Phoenix_Contact

Device types

industrial automation and networking hardware — FL SWITCH industrial Ethernet switches (unmanaged 1000/1100, managed 2000, TSN 2300/5900), industrial routers (LAN/NAT/4G-LTE), WLAN access points (2300/1000, Wi-Fi 6/6E), PLCnext / AXC F PLCs and controllers, serial device servers and gateways [Confirmed] — phoenixcontact.com (industrial-communication), en.wikipedia.org/wiki/Phoenix_Contact

Protocols

PROFINET, EtherNet/IP, PROFIBUS, Modbus, DeviceNet, CANopen, INTERBUS [Confirmed] — phoenixcontact.com

Verified prefixes (all MA-L, Phoenix Contact)

00:A0:45, A8:74:1D, CC:CC:EA [Confirmed] — IEEE MA-L (https://standards-oui.ieee.org/oui/oui.csv)

Usage context

appears in ICS/OT environments — manufacturing, process automation, renewable energy, infrastructure. Not a consumer/home device vendor [Confirmed] — phoenixcontact.com, automationworld.com

Security note

documented ICS/OT CVE history (CISA advisories 2016–2024). Examples: FL SWITCH 3xxx/4xxx/48xx CVE-2018-10730 (CVSS 9.1, arbitrary command execution) and CVE-2018-10731 (CVSS 9.0, stack buffer overflow), fixed in firmware v1.34; PLCnext AXC F 2152 CVE-2018-7559 (CVSS 7.6, key management) and CVE-2019-10997 (CVSS 7.5, MITM/DoS); FL NAT SMx CVE-2019-9744 (CVSS 8.8, config access via active web session). Treat as sensitive OT nodes — isolation, firmware currency, access controls [Confirmed] — ics-cert.kaspersky.com, securityweek.com, cisa.gov (icsa-16-313-01)

Analyst note

a Phoenix Contact OUI on a network strongly indicates industrial networking/automation hardware (switch, router, wireless AP, or PLC) in an ICS/OT context — not a consumer device. MAC randomization is not relevant to these fixed-infrastructure devices.