FL Switch CVE-2025-41697
MEDIUMAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain physical access to device PCB
-
DeliveryAttach serial adapter to undocumented UART header
-
ExploitAuthenticate with credentials from CVE-2025-41692
-
ExecutionObtain root shell over console
-
ImpactFull compromise of switch OS
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Hardware write protection
|
| Exploitation Conditions | Exploitation requires direct physical access to the device's printed circuit board to connect to an undocumented UART (serial console) port - the enclosure must be opened and a serial adapter attached to the header. Per the description, obtaining root also relies on device credentials sourced from CVE-2025-41692, making this a chained/companion attack rather than a standalone one. Limiting factors: AV:P means no network reachability is involved at all, so physical security of the cabinet/installation is the primary control; devices in locked, monitored OT enclosures are substantially harder to attack. This is most relevant for scenarios involving insider threat, supply-chain/shipping tampering, or physically exposed field-deployed switches. |
| Impact | Real-world priority is LOW despite the 6.8 (Medium) CVSS base score, and the score itself is driven by full C:H/I:H/A:H impact gated behind AV:P (physical access). The attacker must have physical possession of or hands-on access to the device's PCB to reach the undocumented UART port - this is not a remote or even adjacent-network issue. EPSS is 0.24% (13th percentile), there is no CISA KEV listing, and no public exploit code was identified, all consistent with a low likelihood of opportunistic exploitation. The signals are internally consistent: physical-only vector + low EPSS + no KEV = a hardware-hardening/supply-chain-tampering concern rather than an internet-facing emergency. Note the vulnerability chains with CVE-2025-41692 (referenced as the source of credentials), so its practical impact depends on that companion flaw; the description does not confirm whether root is obtainable via UART without those credentials. The 'Information Disclosure' tag understates impact - successful exploitation yields root (full confidentiality, integrity, and availability compromise), not mere disclosure. |
| Exploit ScenarioDerived | An attacker with physical access to a deployed FL Switch/FL NAT device (e.g. in an unsecured cabinet, during shipping, or via insider access) opens the enclosure, connects a serial adapter to the undocumented UART header on the PCB, and interacts with the exposed console. Using credentials obtained from CVE-2025-41692, they authenticate and obtain a root shell on the switch's operating system. No public exploit code is identified, and exploitation requires hands-on hardware access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Successful exploitation of an undocumented UART port on the printed circuit board of Phoenix Contact FL Switch and FL NAT industrial Ethernet switches allows an attacker with physical access to obtain root-level control, particularly when combined with credentials harvested via CVE-2025-41692. This chained attack requires opening the device enclosure and attaching a serial adapter; it is not network-reachable. Despite a CVSS base score of 6.8 (Medium), real-world priority is LOW due to the AV:P vector, and EPSS is 0.24% (13th percentile); no public exploit code or CISA KEV entry has been identified at time of analysis.
RemediationAI
No vendor-released patch is identified in the available intelligence; consult the CERT VDE advisory VDE-2025-071 for firmware updates and vendor guidance. Until a patch is applied, the primary mitigation is robust physical security: install devices in locked, monitored cabinets with tamper-evident seals and restrict physical access to authorized personnel only. Because root access also depends on credentials from CVE-2025-41692, address that vulnerability first by rotating any default or hardcoded credentials to strong unique values, if possible, or by updating firmware that fixes the credential exposure. For high-assurance environments, consider disabling or physically removing the UART header (e.g., desoldering or potting the connector) - but be aware this may void the warranty and is not feasible in all installations. Network-level controls (firewalls, segmentation) do not mitigate this physical attack vector. Trade-offs: physical controls are deterrent but not foolproof; tamper seals can be defeated, and monitoring may not detect brief connections.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is classified as CWE-1299 (Missing Protection Mechanism for Alternate Hardware Interface), meaning the device firmware lacks authentication or access controls on a debug UART header that is not documented for end users. This UART provides a direct serial console to the underlying operating system, bypassing normal network-based authentication. An attacker who can physically access the PCB can connect a UART adapter (e.g., via TX/RX/GND pins) and, using credentials obtained from CVE-2025-41692 (likely hardcoded or default credentials), escalate to root. The CVSS vector CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms the physical attack vector, no privileges or user interaction required, and high impact to confidentiality, integrity, and availability. Affected CPEs cover numerous Phoenix Contact FL Switch and FL NAT models across all firmware versions.
Know when Fl Switch 2303 8sp1 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Undocumented UART requires physical PCB access (AV:P) with low complexity and no prior auth on the port itself; a root shell yields full C/I/A compromise.
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
DescriptionCVE.org
An attacker can use an undocumented UART port on the PCB as a side-channel to get root access e.g. with the credentials obtained from CVE-2025-41692.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)CVE.org
More in Fl Switch 2303 8sp1
View allReflected cross-site scripting in the pxc_portSfp.php page of the web-based management (WBM) interface on Phoenix Contac
Reflected cross-site scripting (XSS) in the pxc_portCntr.php endpoint of Phoenix Contact FL SWITCH and FL NAT industrial
Reflected cross-site scripting (CWE-79) in the pxc_PortCfg.php script of Phoenix Contact's web-based management (WBM) in
Cross-site scripting in the pxc_Dot1xCfg.php 802.1X configuration page of Phoenix Contact FL Switch and FL NAT industria
Cross-site scripting in the Phoenix Contact FL SWITCH and FL NAT web-based management (WBM) interface - specifically the
Cross-site scripting in the web-based management (WBM) interface of Phoenix Contact FL SWITCH industrial Ethernet switch
Configuration tampering through cross-site scripting in dyn_conn.php affects the web-based management (WBM) interface of
Reflected cross-site scripting in port_util.php within the web-based management (WBM) interface of Phoenix Contact FL SW
Cross-site scripting in the pxc_portCntr2.php endpoint of the web-based management (WBM) interface of Phoenix Contact FL
Arbitrary command execution with root privileges affects multiple Fl Switch and Fl Nat devices through improper handling
A cross-site scripting vulnerability (CVSS 7.1) that allows an unauthenticated remote attacker. High severity vulnerabil
A CSRF vulnerability in A CSRF vulnerability in the Link Aggregation configuration interface (CVSS 7.1) that allows an u
GitHub PoC
Exploit-DB