CVE-2025-41751

high-risk

Published 2025-12-09

An XSS vulnerability in pxc_portCntr.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.

Do I need to act?

0.20% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.1/10 High

NETWORK / LOW complexity

Affected Products (20)

Fl Nat 2008 Firmware

Fl Nat 2208 Firmware

Fl Nat 2304-2Gc-2Sfp Firmware

Fl Switch 2005 Firmware

Fl Switch 2008 Firmware

Fl Switch 2008F Firmware

Fl Switch 2016 Firmware

Fl Switch 2105 Firmware

Fl Switch 2108 Firmware

Fl Switch 2116 Firmware

Fl Switch 2204-2Tc-2Sfx Firmware

Fl Switch 2205 Firmware

Fl Switch 2206-2Fx Firmware

Fl Switch 2206-2Fx Sm Firmware

Fl Switch 2206-2Fx Sm St Firmware

Fl Switch 2206-2Fx St Firmware

Fl Switch 2206-2Sfx Firmware

Fl Switch 2206-2Sfx Pn Firmware

Fl Switch 2206C-2Fx Firmware

Fl Switch 2207-Fx Firmware

Affected Vendors

Phoenixcontact

References (1)

Vendor Advisory https://certvde.com/de/advisories/VDE-2025-071

/ 100

high-risk

Severity 25/34 · High

Exploitability 1/34 · Minimal

Exposure 28/34 · Critical