FL Switch CVE-2025-41748

Exploitation requires a victim who is currently authenticated to the device's web-based management (WBM) interface and who clicks an attacker-supplied link (UI:R) - the attacker himself is unauthenticated (PR:N). The vulnerable endpoint is the 802.1X configuration page pxc_Dot1xCfg.php on Phoenix Contact FL Switch / FL NAT industrial ethernet switch firmware. Limiting factors: impact is confined to device configuration parameters exposed by the web application (no OS/privileged access), the httpOnly session cookie prevents session takeover, and success depends on the operator having an active WBM session and interacting with the malicious link. Network reachability to the WBM interface is also required, which in typical OT deployments is on a segmented management network.

Signals are largely consistent and point to a genuine but bounded issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1 HIGH) describes a reflected/CSRF-style XSS requiring user interaction, with only Low CIA impacts and a scope change reflecting the crossing from the unauthenticated attacker into the authenticated WBM context. EPSS is notably elevated at 9.77% (95th percentile), which is high for an XSS and likely reflects the broad affected-product footprint and the network reachability; however, EPSS is a statistical prediction, not evidence of exploitation. There is no CISA KEV listing and no public exploit identified, so the real-world status is 'no public exploit identified at time of analysis.' The key mitigating fact - stated explicitly in the description - is that the session cookie carries the httpOnly flag, so session hijacking is not possible; impact is limited to inducing an already-authenticated operator to submit configuration changes to the 802.1X page (pxc_Dot1xCfg.php). No OS-level or privileged-function access is possible. Net: a real but medium-priority issue whose 7.1 score is inflated by the scope-change metric relative to the constrained, interaction-gated, config-only impact.

An attacker crafts a malicious link (or auto-submitting page) targeting the 802.1X configuration endpoint pxc_Dot1xCfg.php and sends it to an operator who is currently logged into the switch's web-based management. When the authenticated user clicks it, the injected script/request executes in their WBM session and alters device configuration parameters. No public exploit code is identified; exploitation requires the victim to be authenticated and to interact with the attacker-supplied link.