Phoenix Contact FL Switch CVE-2025-41752

Exploitation requires (1) a Phoenix Contact FL Switch or FL NAT device with the web-based management (WBM) interface enabled and network-reachable to the attacker's lure delivery path, and (2) an already-authenticated WBM user who clicks the attacker-crafted link to pxc_portSfp.php - the injection is triggered through that victim's active session, not directly by the attacker. Limiting factors: mandatory user interaction (UI:R), the impact ceiling is device web-app configuration parameters only (no OS/system-level or privileged-function access per vendor), and the httpOnly session cookie prevents session hijacking, so the attacker cannot persist as the user beyond the forged config actions.

This is a genuine but modest-severity issue whose signals point to LOW-MEDIUM real-world priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1 MEDIUM) accurately reflects a reflected/CSRF-style XSS in the pxc_portSfp.php page of the web-based management (WBM) interface: network-reachable and unauthenticated to launch, but strictly gated by UI:R - a logged-in WBM operator must click an attacker-supplied link. The scope change (S:C) is justified because the injected script executes in the victim's authenticated browser context to act on the device, but impact is capped at C:L/I:L/A:L because the vendor explicitly states no access to OS internals or privileged functions (only web-app device-config parameters) and confirms the session cookie carries the httpOnly flag, blocking session takeover. The most striking signal is the EPSS score of 9.77% (95th percentile), which is unusually high for a UI-dependent XSS with no public exploit and no KEV listing - this likely reflects the CWE-79 class prior and the large affected-product footprint rather than confirmed weaponization, so it should not be read as evidence of active exploitation. No conflicting data of note: CVSS network vector is consistent with a WBM HTTP interface. Net: prioritize patching on internet- or plant-network-exposed switches, but the click requirement and lack of session/OS impact keep this below critical.

An attacker crafts a malicious link (or a page/email containing one) targeting the pxc_portSfp.php endpoint of a Phoenix Contact FL Switch/FL NAT WBM interface and lures a logged-in device operator into clicking it. The reflected script runs in the operator's authenticated session and silently submits WBM requests that alter device configuration parameters (e.g., SFP/port settings). No public exploit code has been identified at time of analysis, and the httpOnly cookie prevents the attacker from stealing or reusing the session itself.