CVE-2025-41748

highpriority · track · 3EPSS 0.098 · 96 %ileDEEUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
9.77% (96th) EPSS
CVSS 7.1 · high
Is it mine?
278 products
Check your exposure
Who says so?
4 sources
cnnvd · enisa_euvd · cert_bund · phoenix_contact_psirt

EPSS · scored 2026-10-27

An XSS vulnerability in pxc_Dot1xCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedFirmware <3.50 installed on FL NAT 2008phoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL NAT 2208phoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL NAT 2304-2GC-2SFPphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2005phoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2008phoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2008Fphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2016phoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2105phoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2108phoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2116phoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2204-2TC-2SFXphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2205phoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2206-2FXphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2206-2FX SMphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2206-2FX SM STphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2206-2FX STphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2206-2SFXphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2206-2SFX PNphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2206C-2FXphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2207-FXphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2207-FX SMphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2208phoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2208 PNphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2208Cphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2212-2TC-2SFXphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2214-2FXphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2214-2FX SMphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2214-2SFXphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2214-2SFX PNphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2216phoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2216 PNphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2303-8SP1phoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2304-2GC-2SFPphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2306-2SFPphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2306-2SFP PNphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2308phoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2308 PNphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2312-2GC-2SFPphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2314-2SFPphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2314-2SFP PNphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2316phoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2316 PNphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2316/K1phoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2404-2TC-2SFXphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2406-2SFXphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2406-2SFX PNphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2408phoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2408 PNphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2412-2TC-2SFXphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2414-2SFXphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2414-2SFX PNphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2416phoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2416 PNphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2504-2GC-2SFPphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2506-2SFPphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2506-2SFP PNphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2506-2SFP/K1phoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2508phoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2508 PNphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2508/K1phoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2512-2GC-2SFPphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2514-2SFPphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2514-2SFP PNphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2516phoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2516 PNphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2608phoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2608 PNphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2708phoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

  • FixedFirmware <3.50 installed on FL SWITCH 2708 PNphoenix_contact_psirt

    Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.

02

cvss

Technical severity, 0–10. One row per scoring source.

7.1
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.5–7.1

v3.17.1highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Lsecondary · ENISA EU
v3.17.1highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Lsecondary · info@cert.vde.comexploitability 2.8 · impact 3.7
v3.17.1highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Lsecondary · Phoenix Contact PSIRT DE
v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L/E:Usecondary · CVSS-BT (t0sche)
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-79USCWE-79US
05

affected products (278)

Products and version ranges known to be affected.

showing 20 of 278
06

advisories (2)

Vendor and ecosystem advisories describing this.

  • VDE-2025-071Phoenix Contact: Multiple Vulnerabilities in FL SWITCH 2xxx Firmware2025-12-09csaf · phoenix_contact_psirtDE

    Multiple vulnerabilities have been identified in the FL SWITCH 2xxx firmware prior to version 3.50. Two of these (CVE-2025-41692 and CVE-2025-41696) enable an attacker to access the device's file system. Two other vulnerabilities (CVE-2025-41693 and CVE-2025-41694) are related to Denial of Service (DoS) attacks, which partly limit the device's functionality. Another vulnerability (CVE-2025-41697) allows an unauthenticated physical attacker to access a login shell via an undocumented UART port. Furthermore, there are multiple vulnerabilities relating to reflected cross-site scripting in the web-based management of the device. All vulnerabilities have been resolved in firmware version 3.50.

  • WID-SEC-W-2025-2760Phoenix Contact FL SWITCH: Mehrere SchwachstellenDeutsch2025-12-08csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in Phoenix Contact FL SWITCH ausnutzen, um Informationen offenzulegen, um einen Cross-Site Scripting Angriff durchzuführen, um einen Denial of Service Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.

07

also known as (3)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdcert_bundphoenix_contact_psirtNVDCVE.orgMITRE
published 2025-12-09modified 2026-06-17
09

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan