EUVD-2026-12786Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as high-privileged user
-
ExploitCraft malicious HTTP POST request
-
ExecutionInject OS command in Root CA transfer parameter
-
ImpactExecute arbitrary command as root on Linux
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires high-privileged attacker with administrative credentials to access the device's Root CA certificate transfer workflow. Attacker sends crafted HTTP POST requests to trigger command injection on the underlying Linux OS, executing arbitrary commands with root privileges. No victim interaction needed. |
| Impact | The CVSS score of 7.2 (High) reflects significant impact (complete compromise of confidentiality, integrity, and availability) but requires high privileges (PR:H), meaning an attacker must first obtain administrative credentials to the device. The attack vector is network-based (AV:N) with low complexity (AC:L), making exploitation straightforward once authenticated. However, the prerequisite of administrative access substantially reduces real-world risk for environments with strong credential management. No EPSS score is provided in the intelligence data, and no public proof-of-concept or KEV listing exists, suggesting limited active exploitation. The industrial control system (ICS) context elevates concern since these switches are deployed in operational technology environments where compromise could enable lateral movement, traffic manipulation, or disruption of industrial processes. Organizations should prioritize remediation based on whether these devices are exposed to untrusted networks or if administrative interfaces are accessible beyond highly-restricted management networks. This is primarily a defense-in-depth issue rather than an immediately critical external attack vector, but represents severe risk in scenarios where administrative credentials are compromised or insider threats exist. |
| Exploit ScenarioDerived | An attacker who has compromised administrative credentials through phishing, password reuse, or insider access authenticates to the FL SWITCH web management interface over the network. They navigate to the certificate management section and craft a malicious HTTP POST request for the Root CA certificate transfer workflow, injecting shell metacharacters and commands into certificate-related parameters. The vulnerable firmware fails to sanitize the input and executes the injected commands with root privileges on the underlying Linux OS, allowing the attacker to install backdoors, exfiltrate configuration data including credentials for other devices, modify firmware, or pivot to other systems on the industrial network. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 18, 2026
Arbitrary command execution with root privileges affects multiple Fl Switch and Fl Nat devices through improper handling of HTTP POST requests in the Root CA certificate transfer workflow. An authenticated high-privileged attacker can exploit this command injection flaw to execute arbitrary commands on the underlying Linux operating system. No patch is currently available for the affected product versions.
Earlier versions of this analysis (1)
A command injection vulnerability in the Root CA certificate transfer workflow of Phoenix Contact FL SWITCH and FL NAT network switches allows an authenticated administrator to execute arbitrary commands on the underlying Linux operating system with root privileges via crafted HTTP POST requests. The vulnerability affects over 70 models across the FL SWITCH and FL NAT product lines running firmware versions prior to 3.53. While no active exploitation or KEV listing is reported, the vulnerability provides complete system compromise for attackers who have already obtained high-privilege credentials.
RemediationAI
Upgrade all affected Phoenix Contact FL SWITCH and FL NAT devices to firmware version 3.53 or later, as specified in the CERT@VDE advisory at https://certvde.com/de/advisories/VDE-2025-104. Prior to patching, restrict administrative access to the web management interface to trusted management networks only, using firewall rules or VLANs to prevent access from production or untrusted networks. Implement strong password policies and multi-factor authentication where supported to reduce the risk of credential compromise. Monitor administrative access logs for unusual certificate management operations or suspicious POST requests to certificate-related endpoints. Consider placing these devices behind a jump host or bastion server that enforces additional authentication and logging for administrative sessions. Review and rotate administrative credentials after applying the patch to ensure no compromised accounts persist.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 77 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability (CWE-77: Command Injection) affects Phoenix Contact industrial Ethernet switches and NAT routers, specifically in firmware handling certificate management workflows. The affected products include the FL SWITCH 2000-series (ranging from 5 to 16 ports), FL SWITCH 5900-series high-performance switches, and FL NAT network address translation devices, all running Linux-based firmware. The command injection occurs during Root CA certificate transfer operations, where user-supplied input in HTTP POST requests is insufficiently sanitized before being passed to system shell commands. This allows metacharacters or command separators to break out of the intended command context and execute arbitrary OS commands. The vulnerability exists in the web management interface's certificate handling code, where the application fails to properly validate or escape user input before constructing shell commands for certificate installation or transfer operations.
Know when Fl Nat 2008 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A command injection vulnerability in the device’s Root CA certificate transfer workflow allows a high-privileged attacker to send crafted HTTP POST requests that result in arbitrary command execution on the underlying Linux OS with root privileges.
Executive ViewAI
CVE-2026-22317 affects Fl Switch and Fl Nat devices, allowing authenticated high-privileged users to execute arbitrary commands with root access through malformed HTTP POST requests in certificate management workflows. This vulnerability directly threatens network infrastructure security and administrative control, requiring immediate access review and isolation of affected devices until remediation is available.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict root-level administrative access to trusted personnel only with MFA enforcement; (2) Monitor and log all HTTP POST requests to certificate transfer endpoints; (3) Disable certificate transfer functionality if not actively required; (4) Implement network-level access controls to limit administrative connectivity to affected devices; (5) Establish change management procedures requiring approval before any certificate operations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Related Vulnerabilities in Network Device Command/TFTP Injection
View all 2More in Fl Nat 2008
View allA cross-site scripting vulnerability (CVSS 7.1) that allows an unauthenticated remote attacker. High severity vulnerabil
A CSRF vulnerability in A CSRF vulnerability in the Link Aggregation configuration interface (CVSS 7.1) that allows an u
A buffer overflow vulnerability (CVSS 6.5). Remediation should follow standard vulnerability management procedures.
A buffer overflow vulnerability (CVSS 6.5). Remediation should follow standard vulnerability management procedures.
A buffer overflow vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
Denial of service in Stack Overflow and Fl networking devices results from a stack-based buffer overflow in the file ins
A buffer overflow vulnerability (CVSS 4.9) that allows a high-privileged attacker. Remediation should follow standard vu
GitHub PoC
Exploit-DB