FL Switch CVE-2025-41696
MEDIUMAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain physical access to device PCB
-
ExploitAttach serial adapter to undocumented UART header
-
ExecutionAuthenticate with hardcoded creds (CVE-2025-41692)
-
ImpactRead parts of device filesystem
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Credential externalization
MITRE ATT&CK
2 techniques across 2 tactics: Persistence, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires (1) physical access to the device circuit board to reach an undocumented UART serial port (AV:P), and (2) the user hardcoded credentials obtained from the chained CVE-2025-41692 - this CVE cannot be exploited standalone without those credentials. Affected products are Phoenix Contact FL Switch and FL NAT managed industrial ethernet switch firmware families (FL Switch 2xxx series and FL NAT 2xxx). Limiting factors: the physical-access requirement rules out remote or network exploitation entirely, exposure is read-only (no write/integrity or availability impact), and full exploitation depends on the separate hardcoded-credential vulnerability, making this a hands-on, targeted, insider/supply-chain or device-theft scenario rather than a scalable remote attack. |
| Impact | This is a genuinely low-priority issue despite a 'Critical' confidentiality impact sub-metric. The CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 4.6 Medium) is dominated by AV:P - physical access to the device's PCB is required to reach the undocumented UART header. EPSS is 0.21% (10th percentile), there is no CISA KEV listing, and no public exploit code was identified, all of which align with the physical-access constraint: remote mass exploitation is not feasible. The impact is read-only (C:H, I:N, A:N) and the attack is a chain - it depends on hardcoded credentials obtained from CVE-2025-41692, so this CVE alone is not self-contained. All signals are consistent with each other (low EPSS, no KEV, no POC, physical vector), so there is no conflict to reconcile. Bottom line: a real-but-minor local/physical information-disclosure weakness relevant mainly to attackers with hands-on device access, not an urgent remote threat. |
| Exploit ScenarioDerived | An attacker with physical possession of a Phoenix Contact FL Switch (e.g. a stolen, resold, or physically accessible cabinet-mounted unit) opens the enclosure, attaches a serial adapter to the undocumented UART header on the PCB, and logs in using the hardcoded user credentials recovered via CVE-2025-41692. They then read portions of the device filesystem over the serial console. No public exploit code was identified; the primary barrier is physical access and possession of the chained credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Physical attackers with hands-on access to the circuit board of Phoenix Contact FL Switch and FL NAT managed industrial ethernet switches can read portions of the device filesystem by attaching to an undocumented UART port on the PCB, provided they also possess the hardcoded user credentials disclosed separately in CVE-2025-41692. The assessed vector (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 4.6) is physical-only with read-only confidentiality impact and no integrity or availability effect, so remote and network exploitation are not possible; EPSS is 0.21% (10th percentile) and no public exploit code has been identified at time of analysis. Because the UART path requires the chained hardcoded-credential vulnerability, this is a targeted device-theft, insider, or supply-chain scenario rather than a scalable attack, and it remains a genuinely low-priority issue despite the 'High' confidentiality sub-metric.
RemediationAI
No vendor-released patch was identified in the available data at time of analysis, so remediation is primarily physical and credential-based; consult CERT VDE advisory VDE-2025-071 (https://certvde.com/de/advisories/VDE-2025-071) for any firmware updates or service bulletins issued after this assessment. The most effective compensating controls target the AV:P precondition: enforce physical security of cabinets and DIN rails (locked enclosures, restricted maintenance access) and apply tamper-evident seals or labels to detect unauthorized board-level access, accepting that these are procedural and can be bypassed by a determined insider. Because the attack depends on credentials from CVE-2025-41692, prioritizing full remediation of that hardcoded-credential flaw - including any credential rotation or configuration change the vendor offers - removes the chained precondition; treat this CVE as a dependent of that one and track them together. For decommissioned, RMA, or resold units, perform sanitization or factory reset procedures and avoid redeploying devices that have been outside controlled custody, since an attacker with prior physical access could have extracted filesystem data. Network segmentation, firewall rules, and remote-access hardening do not mitigate this issue because the attack path is entirely physical and off-network; investing in network-layer controls here would provide negligible risk reduction. Where the hardware design permits it and the vendor supports it, disable or physically depopulate debug/UART header access as a hardening measure, noting this typically voids warranty and may impact field serviceability; the trade-off is reduced diagnostic capability versus eliminating the physical side channel.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-798 (Use of Hard-coded Credentials), chained with an undocumented hardware debug interface. The device firmware is classified under Phoenix Contact FL Switch and FL NAT managed switch families (CPE strings include cpe:2.3:o:phoenixcontact:fl_switch_2708_pn_firmware, fl_switch_2708_firmware, fl_switch_2608_pn_firmware, fl_switch_2608_firmware, fl_switch_2516_pn_firmware, fl_switch_2516_firmware, fl_switch_2514-2sfp_pn_firmware, fl_switch_2514-2sfp_firmware, fl_switch_2512-2gc-2sfp_firmware, and fl_switch_2508_pn_firmware, with tag data indicating broader coverage of the 2000/2100/2200/2300/2400/2500/2700 FL Switch lines and FL NAT 2008/2208/2304 models). A UART header left accessible on the PCB acts as a side channel: an attacker who physically connects a serial adapter can interact with bootloader/console services and, using the hardcoded credentials from CVE-2025-41692, authenticate and read filesystem contents. The CVSS vector AV:P/AC:L/PR:N/UI:N confirms the attack is not network-reachable, needs low complexity once physical access is achieved, and requires no privileges or user interaction on the session itself - the effective precondition is the separate credential disclosure plus physical possession of or access to the hardware.
Know when Fl Switch 2303 8sp1 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
UART header needs physical board access (AV:P); hardcoded creds mean no legitimate privilege (PR:N); read-only filesystem access yields C:H with I:N/A:N.
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
DescriptionCVE.org
An attacker can use an undocumented UART port on the PCB as a side-channel with the user hardcoded credentials obtained from CVE-2025-41692 to gain read access to parts of the filesystem of the device.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
More in Fl Switch 2303 8sp1
View allReflected cross-site scripting in the pxc_portSfp.php page of the web-based management (WBM) interface on Phoenix Contac
Reflected cross-site scripting (XSS) in the pxc_portCntr.php endpoint of Phoenix Contact FL SWITCH and FL NAT industrial
Reflected cross-site scripting (CWE-79) in the pxc_PortCfg.php script of Phoenix Contact's web-based management (WBM) in
Cross-site scripting in the pxc_Dot1xCfg.php 802.1X configuration page of Phoenix Contact FL Switch and FL NAT industria
Cross-site scripting in the Phoenix Contact FL SWITCH and FL NAT web-based management (WBM) interface - specifically the
Cross-site scripting in the web-based management (WBM) interface of Phoenix Contact FL SWITCH industrial Ethernet switch
Configuration tampering through cross-site scripting in dyn_conn.php affects the web-based management (WBM) interface of
Reflected cross-site scripting in port_util.php within the web-based management (WBM) interface of Phoenix Contact FL SW
Cross-site scripting in the pxc_portCntr2.php endpoint of the web-based management (WBM) interface of Phoenix Contact FL
Arbitrary command execution with root privileges affects multiple Fl Switch and Fl Nat devices through improper handling
A cross-site scripting vulnerability (CVSS 7.1) that allows an unauthenticated remote attacker. High severity vulnerabil
A CSRF vulnerability in A CSRF vulnerability in the Link Aggregation configuration interface (CVSS 7.1) that allows an u
GitHub PoC
Exploit-DB