Phoenix Contact FL SWITCH CVE-2025-41746
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious link/page with forged POST
-
DeliveryTrick authenticated WBM user into loading it
-
ExploitBrowser submits request to pxc_portSecCfg.php
-
ExecutionInject/execute script in WBM context
-
ImpactAlter device configuration parameters
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated web-based management (WBM) user to be tricked into loading attacker-controlled content that submits a manipulated POST request to pxc_portSecCfg.php - i.e., user interaction (UI:R) is mandatory; the attacker themselves is unauthenticated (PR:N). Impact is LIMITED to device configuration parameters exposed through the web application: no access to OS internals or privileged functions, and the httpOnly session cookie flag prevents session takeover. Realistic exploitation depends on the WBM interface being network-reachable by the targeted operator and on that operator being lured to the malicious payload. |
| Impact | Signals conflict and warrant nuanced prioritization. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1 HIGH) reflects a reflected/CSRF-style XSS where an unauthenticated attacker crafts the payload but requires user interaction (UI:R) from an authenticated WBM operator; the scope change (S:C) and only Low CIA impacts are consistent with browser-context script execution rather than server compromise. Notably, the description itself constrains impact: no OS/system-level access, and the session cookie's httpOnly flag prevents session hijacking - so this is genuinely limited to manipulating device configuration parameters reachable through the web UI. EPSS is unusually elevated at 9.77% (95th percentile), which is high for a low-impact scoped XSS and suggests the scoring model weights the PHP web-management attack surface heavily, but EPSS is a probabilistic signal, not evidence of exploitation. There is NO CISA KEV listing and NO public exploit identified at time of analysis, so despite the high EPSS this is not confirmed as actively exploited. Net: a real but moderate priority - remediate as part of normal OT patch cycles, prioritized higher where these switches expose WBM to reachable networks, but not an emergency given UI:R dependency and the httpOnly mitigation limiting real-world impact. |
| Exploit ScenarioDerived | An attacker crafts a malicious page or link that auto-submits a manipulated POST request to pxc_portSecCfg.php on a Phoenix Contact FL Switch's web-based management interface. When a logged-in administrator visits the attacker's content, their browser executes injected script / submits the forged request, altering port-security or device configuration parameters within the web application context. No public exploit code has been identified, and success depends on tricking an authenticated user (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Cross-site scripting in the web-based management (WBM) interface of Phoenix Contact FL SWITCH industrial Ethernet switches - specifically the pxc_portSecCfg.php script - allows an unauthenticated remote attacker to craft malicious content that, once loaded by an authenticated WBM operator, submits a manipulated POST request and changes device configuration parameters exposed through the web application. User interaction by that authenticated operator is mandatory (UI:R), the session cookie is protected by the httpOnly flag so session hijacking is not achievable, and impact is confined to web-facing configuration settings rather than operating-system internals or privileged functions. EPSS is elevated at 9.77% (95th percentile) although no public exploit code has been identified at the time of analysis and the issue is not confirmed as actively exploited.
RemediationAI
No vendor-released patch version could be confirmed from the available data - the CERT VDE advisory VDE-2025-071 (https://certvde.com/de/advisories/VDE-2025-071) is the authoritative source and should be checked for per-model firmware updates from Phoenix Contact, which should be applied as soon as a fixed build is published for each SKU. Until then, apply compensating controls: place the WBM interface on a dedicated out-of-band management VLAN and restrict reachability to a small set of administrative jump hosts via firewall/ACL rules - this blocks the initial network vector but removes the ability to manage the switches from general user or office networks; disable or lock down remote WBM/HTTP access entirely where local console or CLI management suffices, accepting the operational cost of on-site administration; require administrators to use browsers with strict same-site cookie handling and aggressive cross-site request blocking, and to close the WBM session when not in use, since this reduces the chance of a lured POST but depends on operator behavior; and restrict outbound browsing from the management workstation so that an authenticated operator cannot be lured to attacker-controlled content while logged into the device. None of these mitigations eliminate the XSS itself - they only shrink the attack surface - so firmware upgrade remains the definitive fix once available.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a CWE-79 improper neutralization of input during web page generation (cross-site scripting) in the PHP script pxc_portSecCfg.php, part of the embedded web-based management interface running on Phoenix Contact FL SWITCH and FL NAT firmware. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L indicates the attacker is network-facing and unauthenticated, that the compromised component (the WBM application context) differs from the vulnerable component, producing a scope change, and that the attacker's goal is to induce the victim's browser to submit a manipulated POST request to the port security configuration handler. Because the request originates from the authenticated operator's browser, the device accepts it, but the httpOnly attribute on the session cookie prevents the attacker from reading or exfiltrating the session token, so the compromise does not escalate to full session takeover. Per the CPE data, the affected code ships across a very broad industrial switching portfolio - FL SWITCH 2000, 2100, 2200, 2300, 2400, 2500 and 2700 series variants (including PN, K1, FX, SFX, SFP and GC SKUs such as FL SWITCH 2204 2TC 2SFX, 2306 2SFP, 2406 2SFX PN, 2516 PN, 2708 PN) plus FL NAT 2008/2208/2304 devices - all sharing the same embedded management firmware lineage.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated attacker (PR:N) but needs a victim WBM user to act (UI:R); script runs cross-context (S:C) with only Low CIA since httpOnly blocks session theft and impact is confined to config parameters.
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
DescriptionCVE.org
An XSS vulnerability in pxc_portSecCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.
Executive ViewAI
Phoenix Contact FL SWITCH industrial Ethernet switches are affected by a cross-site scripting flaw in the web-based management interface (pxc_portSecCfg.php) that can allow an attacker to alter device configuration settings through the browser session of a logged-in administrator. Because these switches typically sit in OT/industrial networks supporting production and control environments, unauthorized configuration changes could degrade network segmentation, disrupt operations, or weaken defenses in a facility. Leadership should care because no vendor patch is currently available, and remediation depends on access controls and monitoring until the vendor releases a fix.
No vendor-released patch identified at time of analysis. Interim mitigations: disable the web-based management interface where it is not required; restrict WBM access to a dedicated management VLAN or OT network segment with strict firewall/ACL allowlists limited to trusted administrator hosts; require VPN or jump-host access for management sessions; limit administrative accounts to those necessary and avoid using privileged browser sessions for general web browsing; monitor and alert on unexpected changes to switch configuration, particularly port security settings; retain configuration backups to enable rapid restoration; and monitor Phoenix Contact advisories for an eventual firmware fix.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Affected Products (CPE)CVE.org
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
GitHub PoC
Exploit-DB