Phoenix Contact FL Switch CVE-2025-41694
MEDIUMAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege device credentials
-
DeliveryAuthenticate to web management interface
-
ExploitInvoke webshell with empty whitespace command
-
ExecutionServer blocks awaiting more data
-
ImpactWebserver management plane denied
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires valid low-privileged authenticated access to the affected Phoenix Contact FL Switch / FL NAT device's web management interface and its webshell function (PR:L). Exploitation is network-reachable (AV:N) with low complexity (AC:L) and no user interaction, but the authentication requirement means it is realistically limited to insiders or attackers who have already obtained device credentials. Impact is a denial of service confined to the web/management server (the webserver blocks indefinitely awaiting further command data); the description does not indicate the switching/data plane is disrupted. Devices where the management interface is network-segmented and credential-restricted materially reduce exposure. |
| Impact | Signals are consistent and point to a genuine but moderate-severity availability issue, not a critical one. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) yields 6.5 and maps cleanly to the description: a network-reachable, low-complexity attack requiring only low-privileged authentication, producing availability impact only (C:N/I:N). EPSS is low at 0.48% (39th percentile), the vulnerability is not on CISA KEV, and no public exploit code was identified - so there is no evidence of active or imminent widespread exploitation. The A:H rating is defensible because a blocked/hung webserver denies management access to the switch, but note the impact is confined to the web management plane; the description does not claim the switching/data plane is affected. The PR:L requirement is the key limiter: an attacker must already hold valid (low-privilege) credentials to the device's webshell, which substantially narrows the realistic threat to insiders or post-credential-compromise actors rather than anonymous internet scanners. No signals conflict; the vector and description agree. |
| Exploit ScenarioDerived | An attacker holding low-privilege credentials to a Phoenix Contact FL Switch/FL NAT management interface authenticates and invokes the device's webshell with a command consisting solely of whitespace. The server interprets this as an incomplete command and blocks waiting for further data that never arrives, tying up the webserver and denying administrators access to the device management interface. No public proof-of-concept exploit was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Authenticated but low-privileged users can hang the web management server on Phoenix Contact FL SWITCH and FL NAT industrial Ethernet devices by sending an empty webshell command composed only of whitespace - the server blocks indefinitely waiting for additional command data, consuming the connection/worker resource and producing a denial of service of the web interface (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, CWE-770). The flaw affects a very broad installed base spanning the FL SWITCH 2000, 2100, 2200, 2300, 2400, 2500, 2600 and 2700 series plus FL NAT 2208/2304 firmware, and is reachable over the network but requires valid low-privileged credentials on the management interface. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the EPSS score is only 0.48% (39th percentile), so this is a genuine but moderate availability issue rather than a critical one; impact is confined to the web/management server and does not extend to the switching/data plane, and segmentation plus credential restriction materially lowers exposure.
RemediationAI
No vendor-released patch is identified in the available data for CVE-2025-41694, so the primary action is to consult CERT VDE advisory VDE-2025-071 (https://certvde.com/de/advisories/VDE-2025-071) and Phoenix Contact for a firmware update addressing the webshell whitespace-handling defect, and to apply it to all affected FL SWITCH and FL NAT models as soon as it is published; maintain an inventory of the model list above and re-check the advisory for revised firmware. Until a fix is available, apply compensating controls: restrict the web management interface to a dedicated, network-segmented management VLAN and enforce firewall/ACL rules allowing only authorized administrator hosts to reach the management ports, which directly removes the AV:N path for anything other than an already-credentialed insider (trade-off: any legitimate remote admin outside that segment loses access until tunneled or allowed); disable the webshell/diagnostic command function if the platform permits it, accepting loss of that troubleshooting capability; enforce unique, strong credentials and least-privilege accounts on the device so an attacker needing PR:L has to first obtain device logins (trade-off: no effect against an insider who already holds valid low-privileged credentials); and monitor the web management server for hung or unusually persistent HTTP connections so repeated whitespace-command attempts can be detected and the sessions terminated or the interface restarted. Because the impact is confined to the management webserver and not the switching/data plane, these mitigations preserve industrial network availability even if the DoS is triggered.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected platforms are industrial Ethernet switches and NAT routers (Phoenix Contact FL SWITCH and FL NAT families) that expose an embedded HTTP(S) web management interface containing a diagnostic 'webshell' command feature. The root cause is CWE-770, Allocation of Resources Without Limits or Throttling: the webshell command handler does not validate or reject a command payload consisting solely of whitespace, and instead of returning an error it waits on the socket for more data. Because the server blocks rather than timing out or draining the request, a single crafted request from an authenticated low-privileged session ties up a server worker/connection, and repeated requests exhaust the limited resources of the embedded web server. The CVSS vector confirms network reachability (AV:N), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), and a high availability-only impact (C:N/I:N/A:H) with unchanged scope (S:U), i.e., only the management webserver is degraded, not the device's forwarding function. CPE data lists firmware-only entries for FL SWITCH 2708 PN, 2708, 2608 PN, 2608, 2516 PN, 2208C, 2208 PN, 2208, 2207-FX SM and 2207-FX, and the vendor advisory covers a far wider model list, indicating shared firmware code across the product lines.
Know when Fl Switch 2303 8sp1 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable webshell abuse needing only low-privilege credentials (PR:L) and no interaction; impact is availability-only DoS of the management webserver, so C:N/I:N/A:H.
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
DescriptionCVE.org
A low privileged remote attacker can run the webshell with an empty command containing whitespace. The server will then block until it receives more data, resulting in a DoS condition of the websserver.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Fl Switch 2303 8sp1
View allReflected cross-site scripting in the pxc_portSfp.php page of the web-based management (WBM) interface on Phoenix Contac
Reflected cross-site scripting (XSS) in the pxc_portCntr.php endpoint of Phoenix Contact FL SWITCH and FL NAT industrial
Reflected cross-site scripting (CWE-79) in the pxc_PortCfg.php script of Phoenix Contact's web-based management (WBM) in
Cross-site scripting in the pxc_Dot1xCfg.php 802.1X configuration page of Phoenix Contact FL Switch and FL NAT industria
Cross-site scripting in the Phoenix Contact FL SWITCH and FL NAT web-based management (WBM) interface - specifically the
Cross-site scripting in the web-based management (WBM) interface of Phoenix Contact FL SWITCH industrial Ethernet switch
Configuration tampering through cross-site scripting in dyn_conn.php affects the web-based management (WBM) interface of
Reflected cross-site scripting in port_util.php within the web-based management (WBM) interface of Phoenix Contact FL SW
Cross-site scripting in the pxc_portCntr2.php endpoint of the web-based management (WBM) interface of Phoenix Contact FL
Arbitrary command execution with root privileges affects multiple Fl Switch and Fl Nat devices through improper handling
A cross-site scripting vulnerability (CVSS 7.1) that allows an unauthenticated remote attacker. High severity vulnerabil
A CSRF vulnerability in A CSRF vulnerability in the Link Aggregation configuration interface (CVSS 7.1) that allows an u
GitHub PoC
Exploit-DB