EUVD-2026-12788Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) presents a nuanced risk profile: while the attack vector is network-accessible (AV:N) with low attack complexity (AC:L), the requirement for high privileges (PR:H) significantly constrains real-world exploitability, limiting the threat actor pool to administrators or highly-trusted internal users. The vulnerability produces only availability impact (DoS) with no confidentiality or integrity compromise, reducing its severity in most threat models. However, in industrial environments where denial of service can cascade into production disruptions, safety incidents, or operational losses, the real-world impact may exceed the numeric CVSS score. The absence of reported EPSS data, KEV designation, or public POC suggests limited active exploitation in the wild. The broad affected product range (60+ firmware versions documented in EUVD-2025-104) and availability of a specific patch version (3.53) indicate this is a managed vulnerability with vendor response. Risk prioritization should be determined by network exposure of affected switches: devices directly internet-facing or accessible from untrusted administrative networks warrant immediate patching, while air-gapped or strictly access-controlled deployments present lower practical risk. |
| Exploit ScenarioDerived | An authenticated administrator with legitimate management access to an affected FL SWITCH device could craft a malicious HTTP POST request targeting the file installation endpoint with parameter values significantly exceeding expected buffer sizes, triggering a stack overflow that crashes the internal installation process and renders the switch's management interface unresponsive, resulting in denial of service. Alternatively, a compromised administrator account or internal threat actor with device management privileges could deliberately exploit this vulnerability to cause service disruption; while the attack requires elevated privileges and explicit knowledge of the vulnerable endpoint, the ease of crafting oversized POST requests (AC:L) makes this a practical attack vector for insiders. No public proof-of-concept has been identified, indicating the vulnerability remains primarily known to security researchers and patched deployments rather than being actively weaponized in the wild. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 18, 2026
Denial of service in Stack Overflow and Fl networking devices results from a stack-based buffer overflow in the file installation workflow that can be triggered by high-privileged attackers through oversized POST parameters. An authenticated attacker with elevated privileges can crash the affected service by exploiting this memory corruption vulnerability. No patch is currently available for the impacted products.
Earlier versions of this analysis (1)
A stack-based buffer overflow vulnerability exists in Phoenix Contact FL SWITCH industrial network switches affecting firmware versions prior to 3.53, allowing high-privileged attackers to send oversized POST parameters to the device's file installation workflow that overflow a fixed-size stack buffer, resulting in denial of service. With a CVSS score of 4.9 and high availability impact (CWE-121), the vulnerability requires administrative-level access to exploit but affects a broad range of industrial networking devices across multiple product lines. The vulnerability has been documented by CERTVDE and assigned EUVD-2025-104, with patch availability confirmed through firmware version 3.53 and later.
RemediationAI
Immediately upgrade all affected Phoenix Contact FL SWITCH and FL NAT devices to firmware version 3.53 or later, following the vendor's published firmware update procedures documented in the CERTVDE advisory (https://certvde.com/de/advisories/VDE-2025-104) and EUVD database entry. For devices where immediate patching is not operationally feasible, implement network segmentation to restrict HTTP/HTTPS access to the device management interface to only authorized administrative networks and trusted IP ranges, disable the file installation workflow if not actively required for operations, and monitor for unusual POST requests to the affected endpoints. In industrial environments, coordinate patching through change management processes to minimize production impact, and verify firmware authenticity using Phoenix Contact's provided checksums before deployment. Where applicable, deploy a reverse proxy or web application firewall in front of affected switches to validate POST parameter sizes and block oversized requests before they reach the vulnerable code path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 77 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the file installation workflow component of Phoenix Contact FL SWITCH industrial Ethernet switches, which are critical infrastructure networking devices used in industrial automation environments. The root cause is classified as CWE-121 (Stack-based Buffer Overflow), indicating improper input validation on HTTP POST parameters within an internal process handling device file installations. The affected CPE encompasses multiple FL SWITCH product lines including FL SWITCH 2005, 2008, 2016, 2105, 2108, 2116, 2204-2TC-2SFX, 2205, 2206-2FX, and numerous other industrial switch models, as well as FL NAT (Network Address Translation) appliances. The vulnerability is triggered through network-accessible HTTP/HTTPS endpoints that process file upload or configuration installation requests, and exploitation requires sending specially-crafted POST requests with parameter sizes exceeding the fixed stack buffer allocation.
Know when Fl Nat 2008 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A stack-based buffer overflow in the device's file installation workflow allows a high-privileged attacker to send oversized POST parameters that overflow a fixed-size stack buffer within an internal process, resulting in a DoS attack.
Executive ViewAI
CVE-2026-22319 presents moderate security risk, a stack-based buffer overflow vulnerability rated CVSS 4.9. Exploitation could cause memory corruption or application crashes. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: enable ASLR/DEP, apply network segmentation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Related Vulnerabilities in Device Stack-Based Buffer Overflow Vulnerabilities
View all 3More in Fl Nat 2008
View allArbitrary command execution with root privileges affects multiple Fl Switch and Fl Nat devices through improper handling
A cross-site scripting vulnerability (CVSS 7.1) that allows an unauthenticated remote attacker. High severity vulnerabil
A CSRF vulnerability in A CSRF vulnerability in the Link Aggregation configuration interface (CVSS 7.1) that allows an u
A buffer overflow vulnerability (CVSS 6.5). Remediation should follow standard vulnerability management procedures.
A buffer overflow vulnerability (CVSS 6.5). Remediation should follow standard vulnerability management procedures.
GitHub PoC
Exploit-DB