Remote Code Execution Vulnerability in Web Server from CERTVDE
CVE-2025-41694

6.5MEDIUM

Key Information:

Vendor

Phoenix Contact

Status
Fl Switch 2005
Fl Switch 2008
Fl Switch 2016
Fl Switch 2105
Vendor
CVE Published:
9 December 2025

What is CVE-2025-41694?

An attacker with low privileges can exploit a vulnerability in CERTVDE's web server by executing a webshell with an empty command. This manipulation causes the server to enter a blocked state until additional data is received, which can lead to a denial of service condition. Administrators are advised to review server configurations and apply necessary mitigations to defend against this potential attack vector.

Affected Version(s)

FL NAT 2008 0.0.0 < 3.50

FL NAT 2208 0.0.0 < 3.50

FL NAT 2304-2GC-2SFP 0.0.0 < 3.50

References

https://certvde.com/de/advisories/VDE-2025-071

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

D. Blagojevic, S. Dietz, F. Koroknai, T. Weber from CyberDanube
JSON
.
CVE-2025-41694 : Remote Code Execution Vulnerability in Web Server from CERTVDE