Fl Switch 2206 2Sfx Firmware
Monthly
Reflected cross-site scripting in the pxc_portSfp.php page of the web-based management (WBM) interface on Phoenix Contact FL Switch and FL NAT industrial Ethernet devices allows an unauthenticated remote attacker to craft a link that, when clicked by an already-authenticated WBM user, executes script in that user's browser context and alters device configuration parameters exposed by the web application. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) confirms the attacker needs no credentials but does require victim interaction; impact is capped at web-app configuration values, with no access to operating system internals or privileged functions, and the httpOnly session cookie prevents session hijacking. EPSS is 9.77% (95th percentile), indicating elevated short-term exploitation likelihood relative to typical XSS issues, though no public exploit code and no CISA KEV listing were identified at time of analysis.
Reflected cross-site scripting (XSS) in the pxc_portCntr.php endpoint of Phoenix Contact FL SWITCH and FL NAT industrial Ethernet switch firmware allows an unauthenticated remote attacker to socially engineer an operator who is actively logged into the device's web-based management (WBM) interface into clicking a crafted link; the injected script then executes in that authenticated session and can modify device configuration parameters exposed by the web application. CVSS:3.1 rates it 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), with the scope change reflecting the crossed trust boundary between the attacker-supplied link and the operator's privileged WBM session, while the httpOnly session cookie flag prevents session hijacking and no operating-system-level or privileged functions are reachable. EPSS scores the flaw at 9.77% (95th percentile) likelihood of exploitation within 30 days, but there is no CISA KEV listing and no public exploit identified at time of analysis.
Reflected cross-site scripting (CWE-79) in the pxc_PortCfg.php script of Phoenix Contact's web-based management (WBM) interface lets an unauthenticated remote attacker craft a link that, when clicked by an authenticated operator, silently modifies device configuration parameters exposed by the web application. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) confirms the attacker needs no credentials but does depend on victim user interaction, which is the primary limiting factor; EPSS is elevated at 9.77% (95th percentile), though no public exploit code and no CISA KEV listing were identified at time of analysis. Impact is bounded to WBM-scoped settings - the description explicitly rules out access to operating-system internals or privileged functions, and the httpOnly session cookie prevents session hijacking - so risk is genuine but LOW-to-MEDIUM and heavily dependent on whether the WBM interface is reachable and actively used by an operator.
Reflected cross-site scripting in port_util.php within the web-based management (WBM) interface of Phoenix Contact FL SWITCH and FL NAT managed industrial Ethernet switches lets an unauthenticated remote attacker craft a link that, once clicked by an operator who is currently logged in to WBM, alters device-configuration parameters visible in the web application. The CVSS 3.1 base score of 7.1 is driven largely by the S:C scope change rather than by deep impact: confidentiality, integrity, and availability are each rated Low, the httpOnly session cookie prevents session hijacking, and the vendor states no access to operating-system internals or privileged functions is obtained. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and EPSS is low at 0.65% (49th percentile), so this is a genuine but modest-priority issue whose practical risk depends on whether the switch management plane is reachable from untrusted networks.
Cross-site scripting in the pxc_Dot1xCfg.php 802.1X configuration page of Phoenix Contact FL Switch and FL NAT industrial Ethernet switch firmware lets an unauthenticated remote attacker supply a crafted link that, when clicked by a user with an active web-based management (WBM) session, executes script in that user's browser and alters device configuration parameters reachable through the web application. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1) confirms the attacker needs no authentication but does require victim interaction; impact is bounded to WBM-exposed settings, and the httpOnly session cookie prevents session hijacking. EPSS is 9.77% (95th percentile), indicating elevated predicted exploitation activity, but no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV.
Cross-site scripting in the Phoenix Contact FL SWITCH and FL NAT web-based management (WBM) interface - specifically the PHP script pxc_vlanIntfCfg.php - lets an unauthenticated remote attacker craft a malicious POST request that an already-authenticated operator is tricked into submitting, changing VLAN interface configuration parameters in that operator's WBM session. The attacker needs no credentials (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1) but must socially engineer a logged-in administrator into triggering the request, so exploitation depends on victim interaction and on the WBM interface being reachable on the network. Impact is deliberately bounded: the flaw reaches only web-application configuration parameters, not operating-system internals or privileged functions, and the httpOnly session cookie blocks session or credential theft; EPSS is elevated at 9.77% (95th percentile), but no public exploit code or confirmed active exploitation was identified at time of analysis.
Cross-site scripting in the web-based management (WBM) interface of Phoenix Contact FL SWITCH industrial Ethernet switches - specifically the pxc_portSecCfg.php script - allows an unauthenticated remote attacker to craft malicious content that, once loaded by an authenticated WBM operator, submits a manipulated POST request and changes device configuration parameters exposed through the web application. User interaction by that authenticated operator is mandatory (UI:R), the session cookie is protected by the httpOnly flag so session hijacking is not achievable, and impact is confined to web-facing configuration settings rather than operating-system internals or privileged functions. EPSS is elevated at 9.77% (95th percentile) although no public exploit code has been identified at the time of analysis and the issue is not confirmed as actively exploited.
Cross-site scripting in the pxc_portCntr2.php endpoint of the web-based management (WBM) interface of Phoenix Contact FL SWITCH and FL NAT industrial Ethernet switches allows an unauthenticated remote attacker (PR:N) to socially engineer a currently authenticated operator into submitting an attacker-crafted POST request that alters device configuration parameters exposed by the web application (CVSS 7.1, UI:R, scope changed). Impact is bounded: the vulnerability does not reach operating system internals or privileged functions, and the httpOnly session-cookie flag prevents the injected script from stealing or hijacking the authenticated session. EPSS is low (0.65%, ~49th percentile) and no public exploit or confirmed active exploitation was identified at time of analysis; success depends entirely on tricking an authenticated user into interacting with attacker-supplied content.
Successful exploitation of an undocumented UART port on the printed circuit board of Phoenix Contact FL Switch and FL NAT industrial Ethernet switches allows an attacker with physical access to obtain root-level control, particularly when combined with credentials harvested via CVE-2025-41692. This chained attack requires opening the device enclosure and attaching a serial adapter; it is not network-reachable. Despite a CVSS base score of 6.8 (Medium), real-world priority is LOW due to the AV:P vector, and EPSS is 0.24% (13th percentile); no public exploit code or CISA KEV entry has been identified at time of analysis.
Physical attackers with hands-on access to the circuit board of Phoenix Contact FL Switch and FL NAT managed industrial ethernet switches can read portions of the device filesystem by attaching to an undocumented UART port on the PCB, provided they also possess the hardcoded user credentials disclosed separately in CVE-2025-41692. The assessed vector (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 4.6) is physical-only with read-only confidentiality impact and no integrity or availability effect, so remote and network exploitation are not possible; EPSS is 0.21% (10th percentile) and no public exploit code has been identified at time of analysis. Because the UART path requires the chained hardcoded-credential vulnerability, this is a targeted device-theft, insider, or supply-chain scenario rather than a scalable attack, and it remains a genuinely low-priority issue despite the 'High' confidentiality sub-metric.
Configuration tampering through cross-site scripting in dyn_conn.php affects the web-based management (WBM) interface of Phoenix Contact FL SWITCH and FL NAT industrial switches, enabling an unauthenticated remote attacker to trick a concurrently authenticated administrator into submitting a manipulated POST request that alters device configuration parameters. The vulnerability is network-reachable and low-complexity but requires victim interaction (UI:R), and the impact is limited to WBM-exposed settings: no operating system or privileged functions are reachable, and the httpOnly session cookie prevents session hijacking. No public exploit identified at time of analysis; EPSS is 0.66% (50th percentile).
Authenticated but low-privileged users can hang the web management server on Phoenix Contact FL SWITCH and FL NAT industrial Ethernet devices by sending an empty webshell command composed only of whitespace - the server blocks indefinitely waiting for additional command data, consuming the connection/worker resource and producing a denial of service of the web interface (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, CWE-770). The flaw affects a very broad installed base spanning the FL SWITCH 2000, 2100, 2200, 2300, 2400, 2500, 2600 and 2700 series plus FL NAT 2208/2304 firmware, and is reachable over the network but requires valid low-privileged credentials on the management interface. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the EPSS score is only 0.48% (39th percentile), so this is a genuine but moderate availability issue rather than a critical one; impact is confined to the web/management server and does not extend to the switching/data plane, and segmentation plus credential restriction materially lowers exposure.
Authenticated low-privileged users on Phoenix Contact FL Switch and FL NAT industrial Ethernet switches can keep SSH-spawned processes running indefinitely, consuming device resources and degrading management-plane performance. The switching and forwarding data plane is unaffected, so the device stays online and forwarding traffic; only configuration, monitoring, and management responsiveness suffer. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is low at 0.52% (42nd percentile), making this a genuinely low-priority hardening item rather than an urgent patch.
Phoenix Contact FL Switch and FL NAT managed Ethernet switches run firmware that derives the underlying operating system's 'root' and 'user' passwords using a weak generation algorithm, allowing a webUI administrator to brute-force or predict those credentials. Only attackers who already hold an admin account on the device's web management interface can exploit this (PR:H), but success lets them cross from the web layer into the OS, disclosing credentials and files with high confidentiality impact while integrity and availability are unaffected. Exploitation requires network reachability to the webUI; no user interaction is needed. No public exploit code or confirmed active exploitation is currently identified (EPSS 0.30%, ~20th percentile), and the CISA KEV catalog does not list this CVE, so real-world risk is moderate-to-low despite the 6.8 medium CVSS.
Reflected cross-site scripting in the pxc_portSfp.php page of the web-based management (WBM) interface on Phoenix Contact FL Switch and FL NAT industrial Ethernet devices allows an unauthenticated remote attacker to craft a link that, when clicked by an already-authenticated WBM user, executes script in that user's browser context and alters device configuration parameters exposed by the web application. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) confirms the attacker needs no credentials but does require victim interaction; impact is capped at web-app configuration values, with no access to operating system internals or privileged functions, and the httpOnly session cookie prevents session hijacking. EPSS is 9.77% (95th percentile), indicating elevated short-term exploitation likelihood relative to typical XSS issues, though no public exploit code and no CISA KEV listing were identified at time of analysis.
Reflected cross-site scripting (XSS) in the pxc_portCntr.php endpoint of Phoenix Contact FL SWITCH and FL NAT industrial Ethernet switch firmware allows an unauthenticated remote attacker to socially engineer an operator who is actively logged into the device's web-based management (WBM) interface into clicking a crafted link; the injected script then executes in that authenticated session and can modify device configuration parameters exposed by the web application. CVSS:3.1 rates it 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), with the scope change reflecting the crossed trust boundary between the attacker-supplied link and the operator's privileged WBM session, while the httpOnly session cookie flag prevents session hijacking and no operating-system-level or privileged functions are reachable. EPSS scores the flaw at 9.77% (95th percentile) likelihood of exploitation within 30 days, but there is no CISA KEV listing and no public exploit identified at time of analysis.
Reflected cross-site scripting (CWE-79) in the pxc_PortCfg.php script of Phoenix Contact's web-based management (WBM) interface lets an unauthenticated remote attacker craft a link that, when clicked by an authenticated operator, silently modifies device configuration parameters exposed by the web application. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) confirms the attacker needs no credentials but does depend on victim user interaction, which is the primary limiting factor; EPSS is elevated at 9.77% (95th percentile), though no public exploit code and no CISA KEV listing were identified at time of analysis. Impact is bounded to WBM-scoped settings - the description explicitly rules out access to operating-system internals or privileged functions, and the httpOnly session cookie prevents session hijacking - so risk is genuine but LOW-to-MEDIUM and heavily dependent on whether the WBM interface is reachable and actively used by an operator.
Reflected cross-site scripting in port_util.php within the web-based management (WBM) interface of Phoenix Contact FL SWITCH and FL NAT managed industrial Ethernet switches lets an unauthenticated remote attacker craft a link that, once clicked by an operator who is currently logged in to WBM, alters device-configuration parameters visible in the web application. The CVSS 3.1 base score of 7.1 is driven largely by the S:C scope change rather than by deep impact: confidentiality, integrity, and availability are each rated Low, the httpOnly session cookie prevents session hijacking, and the vendor states no access to operating-system internals or privileged functions is obtained. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and EPSS is low at 0.65% (49th percentile), so this is a genuine but modest-priority issue whose practical risk depends on whether the switch management plane is reachable from untrusted networks.
Cross-site scripting in the pxc_Dot1xCfg.php 802.1X configuration page of Phoenix Contact FL Switch and FL NAT industrial Ethernet switch firmware lets an unauthenticated remote attacker supply a crafted link that, when clicked by a user with an active web-based management (WBM) session, executes script in that user's browser and alters device configuration parameters reachable through the web application. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1) confirms the attacker needs no authentication but does require victim interaction; impact is bounded to WBM-exposed settings, and the httpOnly session cookie prevents session hijacking. EPSS is 9.77% (95th percentile), indicating elevated predicted exploitation activity, but no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV.
Cross-site scripting in the Phoenix Contact FL SWITCH and FL NAT web-based management (WBM) interface - specifically the PHP script pxc_vlanIntfCfg.php - lets an unauthenticated remote attacker craft a malicious POST request that an already-authenticated operator is tricked into submitting, changing VLAN interface configuration parameters in that operator's WBM session. The attacker needs no credentials (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1) but must socially engineer a logged-in administrator into triggering the request, so exploitation depends on victim interaction and on the WBM interface being reachable on the network. Impact is deliberately bounded: the flaw reaches only web-application configuration parameters, not operating-system internals or privileged functions, and the httpOnly session cookie blocks session or credential theft; EPSS is elevated at 9.77% (95th percentile), but no public exploit code or confirmed active exploitation was identified at time of analysis.
Cross-site scripting in the web-based management (WBM) interface of Phoenix Contact FL SWITCH industrial Ethernet switches - specifically the pxc_portSecCfg.php script - allows an unauthenticated remote attacker to craft malicious content that, once loaded by an authenticated WBM operator, submits a manipulated POST request and changes device configuration parameters exposed through the web application. User interaction by that authenticated operator is mandatory (UI:R), the session cookie is protected by the httpOnly flag so session hijacking is not achievable, and impact is confined to web-facing configuration settings rather than operating-system internals or privileged functions. EPSS is elevated at 9.77% (95th percentile) although no public exploit code has been identified at the time of analysis and the issue is not confirmed as actively exploited.
Cross-site scripting in the pxc_portCntr2.php endpoint of the web-based management (WBM) interface of Phoenix Contact FL SWITCH and FL NAT industrial Ethernet switches allows an unauthenticated remote attacker (PR:N) to socially engineer a currently authenticated operator into submitting an attacker-crafted POST request that alters device configuration parameters exposed by the web application (CVSS 7.1, UI:R, scope changed). Impact is bounded: the vulnerability does not reach operating system internals or privileged functions, and the httpOnly session-cookie flag prevents the injected script from stealing or hijacking the authenticated session. EPSS is low (0.65%, ~49th percentile) and no public exploit or confirmed active exploitation was identified at time of analysis; success depends entirely on tricking an authenticated user into interacting with attacker-supplied content.
Successful exploitation of an undocumented UART port on the printed circuit board of Phoenix Contact FL Switch and FL NAT industrial Ethernet switches allows an attacker with physical access to obtain root-level control, particularly when combined with credentials harvested via CVE-2025-41692. This chained attack requires opening the device enclosure and attaching a serial adapter; it is not network-reachable. Despite a CVSS base score of 6.8 (Medium), real-world priority is LOW due to the AV:P vector, and EPSS is 0.24% (13th percentile); no public exploit code or CISA KEV entry has been identified at time of analysis.
Physical attackers with hands-on access to the circuit board of Phoenix Contact FL Switch and FL NAT managed industrial ethernet switches can read portions of the device filesystem by attaching to an undocumented UART port on the PCB, provided they also possess the hardcoded user credentials disclosed separately in CVE-2025-41692. The assessed vector (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 4.6) is physical-only with read-only confidentiality impact and no integrity or availability effect, so remote and network exploitation are not possible; EPSS is 0.21% (10th percentile) and no public exploit code has been identified at time of analysis. Because the UART path requires the chained hardcoded-credential vulnerability, this is a targeted device-theft, insider, or supply-chain scenario rather than a scalable attack, and it remains a genuinely low-priority issue despite the 'High' confidentiality sub-metric.
Configuration tampering through cross-site scripting in dyn_conn.php affects the web-based management (WBM) interface of Phoenix Contact FL SWITCH and FL NAT industrial switches, enabling an unauthenticated remote attacker to trick a concurrently authenticated administrator into submitting a manipulated POST request that alters device configuration parameters. The vulnerability is network-reachable and low-complexity but requires victim interaction (UI:R), and the impact is limited to WBM-exposed settings: no operating system or privileged functions are reachable, and the httpOnly session cookie prevents session hijacking. No public exploit identified at time of analysis; EPSS is 0.66% (50th percentile).
Authenticated but low-privileged users can hang the web management server on Phoenix Contact FL SWITCH and FL NAT industrial Ethernet devices by sending an empty webshell command composed only of whitespace - the server blocks indefinitely waiting for additional command data, consuming the connection/worker resource and producing a denial of service of the web interface (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, CWE-770). The flaw affects a very broad installed base spanning the FL SWITCH 2000, 2100, 2200, 2300, 2400, 2500, 2600 and 2700 series plus FL NAT 2208/2304 firmware, and is reachable over the network but requires valid low-privileged credentials on the management interface. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the EPSS score is only 0.48% (39th percentile), so this is a genuine but moderate availability issue rather than a critical one; impact is confined to the web/management server and does not extend to the switching/data plane, and segmentation plus credential restriction materially lowers exposure.
Authenticated low-privileged users on Phoenix Contact FL Switch and FL NAT industrial Ethernet switches can keep SSH-spawned processes running indefinitely, consuming device resources and degrading management-plane performance. The switching and forwarding data plane is unaffected, so the device stays online and forwarding traffic; only configuration, monitoring, and management responsiveness suffer. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is low at 0.52% (42nd percentile), making this a genuinely low-priority hardening item rather than an urgent patch.
Phoenix Contact FL Switch and FL NAT managed Ethernet switches run firmware that derives the underlying operating system's 'root' and 'user' passwords using a weak generation algorithm, allowing a webUI administrator to brute-force or predict those credentials. Only attackers who already hold an admin account on the device's web management interface can exploit this (PR:H), but success lets them cross from the web layer into the OS, disclosing credentials and files with high confidentiality impact while integrity and availability are unaffected. Exploitation requires network reachability to the webUI; no user interaction is needed. No public exploit code or confirmed active exploitation is currently identified (EPSS 0.30%, ~20th percentile), and the CISA KEV catalog does not list this CVE, so real-world risk is moderate-to-low despite the 6.8 medium CVSS.