Phoenix Contact FL Switch CVE-2025-41692
MEDIUMAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain webUI admin access
-
DeliveryEnumerate weak password generation scheme
-
ExploitBrute-force OS root/user passwords
-
ExecutionAuthenticate to underlying OS
-
ImpactFull device/OS compromise
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation requires an authenticated administrator on the device webUI (PR:H) - the attacker must already control a webUI admin account. Given that, the weak password-generation algorithm for the underlying OS lets the admin brute-force/predict the OS 'root' and 'user' passwords, crossing the privilege boundary from web management into the operating system (S:C). Limiting factors: admin-level access is mandatory (no unauthenticated path), the target must be one of the affected Phoenix Contact FL Switch / FL NAT firmware models, and reachability of the management interface (network access to the webUI) is required. No user interaction is needed. |
| Impact | Real-world risk is moderate-to-low despite the 6.8 medium CVSS. All signals point the same direction: exploitation requires PR:H (a valid webUI administrator account), which is the single largest limiting factor - an attacker must already hold admin credentials or session on the switch management interface. EPSS is low at 0.30% (20th percentile), there is no CISA KEV listing, and no public exploit code was identified, so this is not an active or opportunistic threat. The CVSS AV:N/AC:L and S:C (scope change from webUI privilege domain into the underlying OS) legitimately raise the base score, and CWE-916 (weak/insufficient-effort password generation) matches the description of brute-forceable 'root'/'user' OS passwords. Note the vendor scored C:H/I:N/A:N, treating the outcome purely as credential disclosure; in practice recovering the OS root password yields full OS control (integrity/availability impact too), so the base vector arguably understates downstream impact - but the confidentiality-only scoring is a defensible narrow read. No signals conflict; the low EPSS and absence of KEV/POC are consistent with a config/privilege-gated OT flaw, not a widely weaponized bug. |
| Exploit ScenarioDerived | An attacker who has obtained webUI administrator access to a Phoenix Contact FL Switch (via stolen/default/shared credentials or an insider) exploits the predictable password-generation algorithm to derive or brute-force the OS-level 'root' and 'user' account passwords. With those credentials the attacker gains shell-level access to the underlying operating system of the industrial switch, escalating beyond the management UI to full device control. No public POC was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Phoenix Contact FL Switch and FL NAT managed Ethernet switches run firmware that derives the underlying operating system's 'root' and 'user' passwords using a weak generation algorithm, allowing a webUI administrator to brute-force or predict those credentials. Only attackers who already hold an admin account on the device's web management interface can exploit this (PR:H), but success lets them cross from the web layer into the OS, disclosing credentials and files with high confidentiality impact while integrity and availability are unaffected. Exploitation requires network reachability to the webUI; no user interaction is needed. No public exploit code or confirmed active exploitation is currently identified (EPSS 0.30%, ~20th percentile), and the CISA KEV catalog does not list this CVE, so real-world risk is moderate-to-low despite the 6.8 medium CVSS.
RemediationAI
Phoenix Contact's advisory VDE-2025-071 (https://certvde.com/de/advisories/VDE-2025-071) is the authoritative source for fixes and affected firmware revisions; no exact fix version is stated in the available data, so apply the patched firmware release the vendor lists for each switch model as soon as it is published, and treat the absence of a version here as unconfirmed rather than as 'no fix'. Until then, the primary compensating control is to eliminate the prerequisite: audit webUI accounts and remove or disable dormant administrator logins, enforce strong unique webUI admin passwords, and restrict management-interface reachability to a dedicated out-of-band VLAN or firewall allowlist so remote attackers cannot reach the webUI at all - the trade-off is that operational access must come from trusted management hosts only. Additionally, change the underlying OS 'root' and 'user' passwords to high-entropy values if the platform permits it, since the weak generator is the root cause, and monitor for repeated authentication attempts against the OS accounts as an indicator of brute-force exploitation. Note that these mitigations reduce exposure but do not repair the weak password-generation algorithm itself; only vendor firmware closes the issue.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the firmware of Phoenix Contact's FL Switch and FL NAT managed industrial Ethernet switches (a broad model range spanning FL Switch 2005 through 2708 variants, including PN, K1, FX, SFP and GC SKUs, plus FL NAT 2008/2208/2304 models). The root-cause class is CWE-916, Use of Password Hash With Insufficient Computational Effort: the device generates the OS-level 'root' and 'user' credentials with a weak algorithm, so the resulting passwords have low entropy and can be recovered by brute force or by predicting the generator's output. Because the resulting passwords are reused for the switch operating system beneath the web management application, an attacker who already possesses webUI administrator rights (the PL requirement; CVSS PR:H) can pivot into the underlying OS. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N reflects a network-reachable attack with low complexity, no user interaction, and a scope change (S:C) that captures the boundary crossing from the management application to the operating system, with high confidentiality impact from password disclosure but no integrity or availability effect.
Know when Fl Switch 2303 8sp1 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Requires webUI admin (PR:H) reachable over network (AV:N/AC:L); crossing from UI privilege domain to OS credentials is S:C; scored C:H per vendor for password disclosure (though OS root access implies broader impact).
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
DescriptionCVE.org
A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak password generation algorithm.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)CVE.org
More in Fl Switch 2303 8sp1
View allReflected cross-site scripting in the pxc_portSfp.php page of the web-based management (WBM) interface on Phoenix Contac
Reflected cross-site scripting (XSS) in the pxc_portCntr.php endpoint of Phoenix Contact FL SWITCH and FL NAT industrial
Reflected cross-site scripting (CWE-79) in the pxc_PortCfg.php script of Phoenix Contact's web-based management (WBM) in
Cross-site scripting in the pxc_Dot1xCfg.php 802.1X configuration page of Phoenix Contact FL Switch and FL NAT industria
Cross-site scripting in the Phoenix Contact FL SWITCH and FL NAT web-based management (WBM) interface - specifically the
Cross-site scripting in the web-based management (WBM) interface of Phoenix Contact FL SWITCH industrial Ethernet switch
Configuration tampering through cross-site scripting in dyn_conn.php affects the web-based management (WBM) interface of
Reflected cross-site scripting in port_util.php within the web-based management (WBM) interface of Phoenix Contact FL SW
Cross-site scripting in the pxc_portCntr2.php endpoint of the web-based management (WBM) interface of Phoenix Contact FL
Arbitrary command execution with root privileges affects multiple Fl Switch and Fl Nat devices through improper handling
A cross-site scripting vulnerability (CVSS 7.1) that allows an unauthenticated remote attacker. High severity vulnerabil
A CSRF vulnerability in A CSRF vulnerability in the Link Aggregation configuration interface (CVSS 7.1) that allows an u
GitHub PoC
Exploit-DB