CVE-2025-41749

high-risk
Published 2025-12-09

An XSS vulnerability in port_util.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.

Do I need to act?

-
0.14% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.1/10 High
NETWORK / LOW complexity

Affected Products (20)

Fl Switch 2008F Firmware
Fl Switch 2016 Firmware
Fl Switch 2105 Firmware
Fl Switch 2108 Firmware
Fl Switch 2116 Firmware
Fl Switch 2204-2Tc-2Sfx Firmware
Fl Switch 2205 Firmware
Fl Switch 2206-2Fx Firmware
Fl Switch 2206-2Fx Sm Firmware
Fl Switch 2206-2Fx Sm St Firmware
Fl Switch 2206-2Fx St Firmware
Fl Switch 2206-2Sfx Firmware
Fl Switch 2206-2Sfx Pn Firmware
Fl Switch 2206C-2Fx Firmware
Fl Switch 2207-Fx Firmware
Fl Switch 2207-Fx Sm Firmware
Fl Switch 2208 Firmware
Fl Switch 2208 Pn Firmware
Fl Switch 2208C Firmware
Fl Switch 2212-2Tc-2Sfx Firmware

Affected Vendors

Phoenixcontact

References (1)

Vendor Advisory https://certvde.com/de/advisories/VDE-2025-071
54
/ 100
high-risk
Severity 25/34 · High
Exploitability 1/34 · Minimal
Exposure 28/34 · Critical