FL SWITCH CVE-2025-41695

Exploitation requires a victim who is concurrently authenticated to the device's web-based management (WBM) interface and who interacts with attacker-controlled content (UI:R); the attacker is themselves unauthenticated (PR:N). The vulnerable endpoint is dyn_conn.php on Phoenix Contact FL SWITCH / FL NAT series industrial switch firmware. Limiting factors: impact is confined to WBM device-configuration parameters (no OS or privileged-function access), the httpOnly session cookie blocks session hijacking, and the attack fails against any administrator not currently logged in or who does not open the malicious content. Realistic exposure depends on the WBM being reachable via the attacker's delivery path and on the presence of active administrator sessions.

The vendor-supplied CVSS 3.1 vector (7.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) describes a network-reachable, low-complexity XSS whose PR:N reflects that the attacker themselves is unauthenticated, while UI:R correctly captures the hard dependency on tricking an already-authenticated WBM user into interacting with attacker content. The scope change (S:C) and the low C/I/A triad are consistent with the description: the payload executes in the victim's browser session against the web application, not the underlying OS. Real-world urgency is moderate, not critical - EPSS is only 0.66% (50th percentile), there is no CISA KEV listing (not confirmed actively exploited) and no public exploit identified at time of analysis, so this is a plausible-but-not-imminent risk rather than a widespread automated-exploitation threat. Two mitigations explicitly stated by the vendor further cap impact: the httpOnly flag prevents session-cookie theft/takeover, and access is limited to WBM configuration parameters with no path to system internals or privileged functions. Net: a genuine but second-tier priority - patch in normal maintenance cycles, prioritizing devices in exposed or safety-relevant OT segments.

An attacker crafts a malicious web page or email link and social-engineers an administrator who is currently logged into a Phoenix Contact FL Switch/FL NAT web-based management interface into visiting it. The victim's browser is driven to submit a manipulated POST request to dyn_conn.php, executing script in the WBM context and silently altering device configuration parameters. No public exploit code is identified at time of analysis, and success requires the low-complexity but mandatory step of the victim being authenticated and interacting with the attacker content.