Phoenix Contact FL Switch CVE-2025-41693
MEDIUMAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-priv SSH credentials
-
DeliveryReach device management interface
-
ExploitLog in and execute commands
-
ExecutionSpawn processes that hold resources
-
PersistExhaust device resources
-
ImpactDegrade management-plane performance
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the SSH management feature to be enabled and network-reachable, plus valid low-privileged login credentials to the FL Switch/FL NAT management interface (PR:L). Exploitation is limited to degrading management functions only - device switching/forwarding remains operational - so this cannot take the device offline. The vulnerability is post-authentication: an attacker must first log in via SSH before executing the resource-holding commands. Limiting factors: credential requirement, SSH exposure of the management plane, and the confined availability impact (no data-plane, confidentiality, or integrity effect). |
| Impact | This is a genuinely low-priority issue despite a network attack vector. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) yields only 4.3 (Medium-low), and the impact is availability-only (A:L) with no confidentiality or integrity effect. Critically, PR:L means the attacker must already hold valid low-privileged credentials to the device's SSH service, which sharply limits the exploit population versus an unauthenticated flaw. EPSS is 0.52% (42nd percentile) - modest and consistent with a low-severity DoS in niche OT hardware. There is no CISA KEV listing and no public exploit code identified, so this is no public exploit identified at time of analysis. The signals are mutually consistent (low CVSS, low EPSS, no KEV, no POC) with no conflicts. The realistic worst case is degraded management-plane performance, not device outage - the description explicitly states switching (data-plane forwarding) is unaffected, so production traffic continues even during exploitation. Net: a real but low-urgency issue best handled in normal OT patch cycles rather than emergency response. |
| Exploit ScenarioDerived | An attacker who has obtained low-privileged SSH credentials to a Phoenix Contact FL Switch/FL NAT management interface logs in and issues commands that spawn processes which remain open and hold resources. Repeating this exhausts device resources and degrades the management functions (WBM/CLI responsiveness), though Ethernet switching keeps forwarding traffic. No public proof-of-concept is known, and exploitation requires valid credentials plus SSH reachability to the management plane. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Authenticated low-privileged users on Phoenix Contact FL Switch and FL NAT industrial Ethernet switches can keep SSH-spawned processes running indefinitely, consuming device resources and degrading management-plane performance. The switching and forwarding data plane is unaffected, so the device stays online and forwarding traffic; only configuration, monitoring, and management responsiveness suffer. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is low at 0.52% (42nd percentile), making this a genuinely low-priority hardening item rather than an urgent patch.
RemediationAI
No vendor-released patch version is identified in the available data, so organisations should track the Phoenix Contact / CERT VDE advisory VDE-2025-071 (https://certvde.com/de/advisories/VDE-2025-071) for the firmware update and apply it once published. Because the weakness is post-authentication and confined to the management plane, the most effective compensating control is to remove the attack surface: disable the SSH management interface on any FL Switch/FL NAT device that does not require remote CLI access (trade-off: you lose remote command-line administration and must fall back to the web UI or local console). Where SSH must remain enabled, restrict TCP/22 on the management VLAN to a small set of trusted administrative hosts or a jump host via switch/router ACLs or an OT firewall (trade-off: legitimate admins working from other segments lose direct access and must route through the jump host), and force key-based authentication with unique, least-privilege accounts so credential misuse is easier to detect and contain. Additional hardening includes monitoring for long-lived or accumulating SSH sessions on the management plane (e.g. alerting on session counts or CPU/management-response-time anomalies) and rate-limiting SSH connection attempts at the network edge; note that network-layer monitoring cannot stop an already-authenticated low-privileged user from holding a session, so it is a detection control rather than a prevention one. Since the data plane and switching functionality are unaffected, there is no need for emergency network isolation - this can be scheduled as routine firmware-maintenance and access-hardening work.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a resource-allocation weakness (CWE-770: Allocation of Resources Without Limits or Throttling) in the embedded firmware of Phoenix Contact's FL Switch and FL NAT families of DIN-rail industrial Ethernet switches. The management plane exposes an SSH service; once a low-privileged user authenticates (PR:L per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), that user can issue commands that leave a process open and holding resources instead of terminating cleanly. Because the firmware does not bound or reap these sessions, repeated or sustained use accumulates resource pressure that slows the management functions (web/CLI/SNMP-style configuration and monitoring tasks). The memory/process budget is shared with the management daemons on these small-footprint embedded devices, which is why availability of management functions degrades while the hardware-accelerated switching fabric (ASIC forwarding, VLANs, spanning tree) continues to operate normally. CPE data identifies the affected firmware images across FL Switch 2000/2100/2200/2300/2400/2500/2700 series and FL NAT 2008/2208/2304 models, i.e. the entire current generation of Phoenix Contact managed switches, confirming this is a firmware-wide design limitation rather than a single model defect.
Know when Fl Switch 2303 8sp1 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Network-reachable SSH (AV:N/AC:L), authenticated low-priv login required (PR:L), no UI, and impact confined to management-plane availability degradation (A:L; C:N/I:N).
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
DescriptionCVE.org
A low privileged remote attacker can use the ssh feature to execute commands directly after login. The process stays open and uses resources which leads to a reduced performance of the management functions. Switching functionality is not affected.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Fl Switch 2303 8sp1
View allReflected cross-site scripting in the pxc_portSfp.php page of the web-based management (WBM) interface on Phoenix Contac
Reflected cross-site scripting (XSS) in the pxc_portCntr.php endpoint of Phoenix Contact FL SWITCH and FL NAT industrial
Reflected cross-site scripting (CWE-79) in the pxc_PortCfg.php script of Phoenix Contact's web-based management (WBM) in
Cross-site scripting in the pxc_Dot1xCfg.php 802.1X configuration page of Phoenix Contact FL Switch and FL NAT industria
Cross-site scripting in the Phoenix Contact FL SWITCH and FL NAT web-based management (WBM) interface - specifically the
Cross-site scripting in the web-based management (WBM) interface of Phoenix Contact FL SWITCH industrial Ethernet switch
Configuration tampering through cross-site scripting in dyn_conn.php affects the web-based management (WBM) interface of
Reflected cross-site scripting in port_util.php within the web-based management (WBM) interface of Phoenix Contact FL SW
Cross-site scripting in the pxc_portCntr2.php endpoint of the web-based management (WBM) interface of Phoenix Contact FL
Arbitrary command execution with root privileges affects multiple Fl Switch and Fl Nat devices through improper handling
A cross-site scripting vulnerability (CVSS 7.1) that allows an unauthenticated remote attacker. High severity vulnerabil
A CSRF vulnerability in A CSRF vulnerability in the Link Aggregation configuration interface (CVSS 7.1) that allows an u
GitHub PoC
Exploit-DB