Phoenix Contact FL SWITCH CVE-2025-41745

Exploitation requires a victim who is currently authenticated to the switch's web-based management (WBM) interface to be socially engineered into submitting an attacker-crafted POST request to the pxc_portCntr2.php endpoint (UI:R) - the attacker themselves needs no credentials (PR:N). Limiting factors: success depends on active operator interaction with attacker-supplied content; impact is confined to device configuration parameters exposed in the web application (no OS/privileged-function access); and the httpOnly session cookie flag prevents the injected script from stealing or hijacking the authenticated session. Affected devices are Phoenix Contact FL SWITCH 2xxx and FL NAT 2xxx series firmware.

This is a moderate-severity reflected/DOM XSS (CWE-79) in the pxc_portCntr2.php endpoint of Phoenix Contact FL SWITCH and FL NAT industrial managed Ethernet switches. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1) shows the attacker is network-based and unauthenticated (PR:N), but exploitation is gated on user interaction (UI:R): an authenticated operator must be tricked into submitting a manipulated POST request to their own device. EPSS is 0.65% (49th percentile) - squarely middling, indicating no signal of imminent mass exploitation. There is no CISA KEV listing and no public exploit code was provided, so exploitation status is: no public exploit identified at time of analysis. Notably, the vendor explicitly states impact is capped at web-application device-configuration parameters (no OS/system-level access) and that the session cookie carries the httpOnly flag, so classic session hijacking is NOT possible - this materially lowers real-world impact versus a typical XSS and is consistent with the C:L/I:L/A:L (all Low) impact metrics rather than High. Net: a real but not high-priority issue for most defenders; priority rises for OT/ICS environments where these switches sit in sensitive network segments, but the UI:R requirement and limited impact keep it below drive-by/wormable severity.

An attacker crafts a malicious web page or email link that, when opened by a logged-in switch administrator, causes the victim's browser to submit a manipulated POST to pxc_portCntr2.php on the target device, injecting script that executes in the WBM context. Because exploitation requires an already-authenticated victim to be socially engineered into triggering the request (UI:R), and impact is limited to changing device configuration parameters (httpOnly prevents session theft), success depends on operator interaction rather than a direct remote takeover. No public proof-of-concept was identified at time of analysis.