Phoenix Contact FL SWITCH CVE-2025-41749
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious port_util.php link
-
DeliveryDeliver link to authenticated WBM admin
-
ExploitAdmin clicks, XSS executes in session
-
ExecutionScript submits WBM config changes
-
ImpactDevice configuration parameters altered
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an unauthenticated attacker to deliver a crafted link targeting port_util.php in the web-based management (WBM) interface AND a victim who is currently authenticated to that WBM to click it (UI:R). Impact is limited to WBM device-configuration parameters - the description explicitly states no access to operating-system internals or privileged functions, and the httpOnly session cookie flag prevents session takeover. Limiting factors: mandatory user interaction by an authenticated operator, no session-hijack capability, and OT-network reachability of the switch's management interface (management planes are commonly segmented in ICS environments). |
| Impact | This is a genuine but modest-priority issue: a high-ish CVSS (7.1) driven mostly by the S:C scope change, not by real-world impact. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) shows the attacker is unauthenticated over the network but MUST get an already-authenticated WBM user to click a crafted link (UI:R), which is the dominant limiting factor. Impact metrics are all Low, and the description explicitly caps the damage to web-application device-configuration parameters - no OS-level or privileged-function access - while the httpOnly cookie flag prevents session hijacking, so this is XSS-for-config-tampering, not for full device takeover. EPSS is 0.65% (49th percentile), i.e. middling probability, and there is no CISA KEV listing and no public exploit identified, so exploitation is neither confirmed nor demonstrably easy. Notably, EPSS here (0.65%) is far lower than the sibling advisories in the same VDE-2025-071 bundle, so treat cross-CVE EPSS comparison with caution. Net: real issue, worth patching in OT change windows, but the UI:R requirement plus OT/ICS niche footprint keep true risk at LOW-MEDIUM rather than the raw score's HIGH. |
| Exploit ScenarioDerived | An attacker crafts a URL targeting port_util.php on a Phoenix Contact FL Switch's web-based management interface with an injected script payload, then phishes or otherwise lures an administrator who is already logged into the WBM. When the admin clicks the link, the script executes in their authenticated browser context and issues configuration-change requests to the switch. No public exploit code is identified at time of analysis, and success requires the victim to be authenticated and to click the link. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Reflected cross-site scripting in port_util.php within the web-based management (WBM) interface of Phoenix Contact FL SWITCH and FL NAT managed industrial Ethernet switches lets an unauthenticated remote attacker craft a link that, once clicked by an operator who is currently logged in to WBM, alters device-configuration parameters visible in the web application. The CVSS 3.1 base score of 7.1 is driven largely by the S:C scope change rather than by deep impact: confidentiality, integrity, and availability are each rated Low, the httpOnly session cookie prevents session hijacking, and the vendor states no access to operating-system internals or privileged functions is obtained. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and EPSS is low at 0.65% (49th percentile), so this is a genuine but modest-priority issue whose practical risk depends on whether the switch management plane is reachable from untrusted networks.
RemediationAI
The input data does not identify a specific fixed firmware version, so no vendor-released patch version can be cited here: consult the CERT VDE advisory VDE-2025-071 (https://certvde.com/de/advisories/VDE-2025-071) for the current patched firmware release for each FL SWITCH and FL NAT model and apply it, since the CPE entries cover wildcard versions across the entire product line. Where immediate upgrade is not possible, the most effective compensating control is to remove reachability of the WBM interface from untrusted networks: place switch management on a dedicated, segmented management VLAN, block TCP/80 and TCP/443 to the switch from user and IT networks with firewall/ACL rules, and disable the web-based management service entirely on switches where it is not operationally required (trade-off: loss of browser-based configuration, requiring alternative provisioning such as SNMP or command-line tooling). Additional actions: instruct operators never to follow unsolicited links while a WBM session is authenticated, and to log out of WBM when finished (trade-off: vigilance-based and only partially effective against crafted links); restrict which administrator workstations may reach the management plane and use isolated browser profiles for device administration (trade-off: added operational overhead, but reduces the chance of a click-through in a session-bearing browser). Because exploitation requires an authenticated operator to click a crafted link, limiting who can log into WBM and how they reach it materially reduces exposure. There is no session-hijack risk to mitigate thanks to the httpOnly cookie flag, and no public exploit code has been identified at time of analysis.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e. cross-site scripting) in the PHP script port_util.php, part of the embedded web server that provides the Web-Based Management (WBM) interface on Phoenix Contact FL SWITCH and FL NAT managed switches. Because the script reflects attacker-controlled input into a response rendered in the victim's browser without adequate output encoding, script executes in the WBM origin - which is why the CVSS vector assigns Scope Changed (S:C) and requires user interaction (UI:R) with an already-authenticated operator. The requirement of an authenticated victim is a genuine limiting factor: the attacker is unauthenticated (PR:N) but cannot act alone. The impact ceiling is deliberately bounded in the vendor description - the injected script can read and modify WBM-visible device-configuration parameters only, cannot reach OS internals or privileged functions, and cannot exfiltrate the session cookie because it carries the httpOnly flag. Affected CPE entries (e.g. cpe:2.3:o:phoenixcontact:fl_switch_2008f_firmware, fl_switch_2016_firmware, fl_switch_2105_firmware, fl_switch_2108_firmware, fl_switch_2116_firmware, fl_switch_2204-2tc-2sfx_firmware, fl_switch_2205_firmware, fl_switch_2206-2fx_firmware, fl_switch_2206-2fx_sm_firmware, fl_switch_2206-2fx_sm_st_firmware) use wildcard version numbers, indicating the flaw is present across firmware revisions of these switch families rather than in a single build.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated network XSS (PR:N/AV:N) needing a click by an authed user (UI:R); script runs in the app's browser context (S:C) with Low CIA capped at WBM config, not OS.
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
DescriptionCVE.org
An XSS vulnerability in port_util.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.
Executive ViewAI
Phoenix Contact FL SWITCH and FL NAT managed industrial Ethernet switches contain a reflected cross-site scripting flaw in their web-based management interface that could let an attacker alter device-configuration parameters when an operator clicks a malicious link. Because these devices often underpin industrial network connectivity, a successful manipulation could lead to operational disruption or misconfiguration, though current exploitation is limited: no public exploit identified at time of analysis, EPSS is low, and there is no CISA KEV listing. Leadership should prioritize protective measures for management interfaces, especially where they are exposed beyond trusted networks, while awaiting a vendor patch.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict WBM access to trusted management networks or VPN, disable WBM if not operationally required, segment management plane from untrusted networks, enforce operator awareness for phishing links, monitor for anomalous configuration changes, and apply vendor workarounds when published.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Affected Products (CPE)CVE.org
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
GitHub PoC
Exploit-DB