Phoenix Contact FL Switch CVE-2025-41750

Exploitation requires a victim who is an actively authenticated user of the device's web-based management (WBM) interface and who clicks an attacker-supplied link targeting pxc_PortCfg.php - this user interaction (UI:R) is the primary limiting factor. The attacker themselves needs no credentials (PR:N) and only network reachability to induce the request. Impact is bounded to configuration parameters exposed within the web application context: the description explicitly rules out operating-system internals and privileged functions, and the httpOnly session cookie prevents session takeover. Realistic risk therefore depends on the WBM being reachable/in-use by an operator and on that operator being social-engineered into clicking; air-gapped or tightly-segmented OT networks with no operator web browsing reduce exposure substantially.

Signals are consistent and point to a genuine but bounded (LOW-to-MEDIUM) risk. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L = 7.1) is internally coherent with the description: network-reachable, no privileges needed by the attacker, but requiring user interaction (an authenticated WBM operator must click the attacker's link), with only Low impact to each of C/I/A because access is confined to device configuration parameters - the description explicitly states no OS-level or privileged-function access, and the httpOnly session cookie prevents session hijacking. This is a CSRF/reflected-XSS class issue, not an RCE. The standout signal is EPSS at 9.77% (95th percentile), which is high relative to the modest CVSS and unusual for a reflected XSS requiring UI:R - it likely reflects the large, heavily-enumerated affected-product fleet and CWE-79 base rates rather than evidence of actual campaigns. There is NO CISA KEV listing and NO public POC, so the EPSS number should be read as model-estimated propensity, not confirmed activity: no active exploitation is claimed. Net: a real defect worth patching in OT/ICS change windows, but not an emergency; the UI:R requirement and lack of session-takeover meaningfully cap real-world impact.

An attacker crafts a malicious link targeting the pxc_PortCfg.php port-configuration page of a Phoenix Contact FL Switch/FL NAT device and delivers it (email, chat, forum) to an operator who is currently logged into the switch's web-based management. When the operator clicks, their browser submits the attacker's payload in their authenticated context, altering port/device configuration parameters. No public exploit code is identified at time of analysis, and the httpOnly cookie flag prevents the attacker from stealing the session itself.