Phoenix Contact FL SWITCH CVE-2025-41751

Exploitation requires that a legitimate user be actively authenticated to the device's web based management (WBM) interface AND that this user be socially engineered into clicking an attacker-supplied link targeting pxc_portCntr.php. The attacker themselves needs no credentials (PR:N), but the attack cannot succeed without the victim's authenticated session and the UI:R click. Impact is limited to device configuration parameters exposed in the web application; the httpOnly session cookie flag prevents session hijacking, and no operating-system-level or privileged functions are reachable. Exposure is further limited where the WBM is segmented on an isolated OT network unreachable by the attacker's delivery channel.

Signals are consistent and point to a genuine but bounded risk. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1) describes a network-reachable, low-complexity reflected XSS that requires user interaction (UI:R) and produces only Low confidentiality/integrity/availability impact with a scope change (S:C) because the injected script runs in the authenticated WBM user's browser context rather than the attacker's. I concur with this vector. The notable signal is EPSS: 9.77% at the 95th percentile is unusually elevated for a reflected/CSRF-style XSS with no public exploit, suggesting the model weights it toward likely exploitation - but EPSS reflects statistical probability, not confirmed activity. There is no CISA KEV listing and no POC identified, so this is NOT confirmed active exploitation; the high EPSS should be read as elevated model-predicted interest, not weaponization. The description explicitly bounds the impact: no access to OS internals or privileged functions, and the httpOnly flag on the session cookie prevents session takeover, so the realistic worst case is tricking an already-authenticated operator into changing device configuration parameters - not code execution or credential theft. Net: a real, prioritizable web-management flaw in OT switching gear, but materially constrained by the UI:R requirement (a logged-in admin must click an attacker link) and the low technical impact ceiling.

An attacker crafts a malicious link targeting pxc_portCntr.php on a Phoenix Contact FL Switch/FL NAT web management interface and delivers it to an operator who is currently logged into the WBM (via email, chat, or a watering-hole page). When the authenticated operator clicks the link, the injected script executes in their WBM session context and issues requests that alter device configuration parameters. No public exploit code has been identified at time of analysis, and the attack cannot capture the session cookie because of the httpOnly flag.