FL SWITCH CVE-2025-41747

Requires an attacker to induce an already-authenticated Web-Based Management (WBM) user to submit a crafted POST request to pxc_vlanIntfCfg.php - i.e., a victim operator must have an active authenticated WBM session and must be socially engineered into triggering the request (UI:R). The attacker themselves needs no credentials (PR:N) and only network reachability to the device's WBM interface, which in properly segmented OT networks is typically restricted to management VLANs. Impact is limited to web-application configuration parameters accessible in that session; it does NOT reach operating-system internals or privileged functions, and the httpOnly session cookie prevents session/credential theft. Limiting factors: mandatory authenticated-victim interaction, WBM network exposure, and configuration-only (not system-level) impact.

Signals are mixed and point to a genuine but bounded issue. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L = 7.1) describes a network-reachable, low-complexity flaw needing NO attacker authentication but REQUIRING victim interaction (UI:R) - consistent with the description's reflected-XSS/CSRF pattern where an unauthenticated attacker must lure an already-authenticated WBM operator into submitting a crafted POST. The scope change (S:C) and only-Low CIA reflect that impact is confined to web-application configuration parameters; the description explicitly rules out OS/system-level access and states the httpOnly session cookie prevents session takeover, so this is not an RCE or account-hijack primitive. EPSS is notably high at 9.77% (95th percentile), which is unusual for a UI-dependent XSS and likely reflects the large affected-product family and public VDE advisory rather than confirmed mass exploitation. There is no CISA KEV listing and no public exploit identified at time of analysis, so the high EPSS should be read as elevated predicted interest, not active in-the-wild use. Net: a real, patch-worthy OT/ICS issue but LOW-to-MEDIUM real-world priority - the user-interaction requirement and configuration-only impact meaningfully cap it below the 7.1 headline, especially in segmented industrial networks.

An unauthenticated attacker crafts a malicious link or web page that triggers a POST to pxc_vlanIntfCfg.php on a targeted Phoenix Contact FL Switch/FL NAT device, then lures a logged-in WBM administrator (e.g., via phishing) into loading it while their session is active. The forged request executes injected script in the WBM context and alters VLAN/device configuration parameters the operator can access. No public exploit code is identified, and success depends on catching an authenticated operator with a live session.