XSS Vulnerability in pxc_portSecCfg.php Affects Network Device Management
CVE-2025-41746

7.1HIGH

Key Information:

Vendor

Phoenix Contact

Status
Fl Switch 2005
Fl Switch 2008
Fl Switch 2016
Fl Switch 2105
Vendor
CVE Published:
9 December 2025

What is CVE-2025-41746?

An XSS vulnerability in the pxc_portSecCfg.php file could allow an unauthenticated remote attacker to craft a malicious POST request. This request may exploit the web-based management interface, tricking an authenticated user into changing specific device configuration parameters. Importantly, the vulnerability does not enable access to deeper system resources or privileged functionalities, as the session cookie is secured with the httpOnly flag. This limitation helps prevent session hijacking of authenticated users.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

FL NAT 2008 0.0.0 < 3.50

FL NAT 2208 0.0.0 < 3.50

FL NAT 2304-2GC-2SFP 0.0.0 < 3.50

References

https://certvde.com/de/advisories/VDE-2025-071

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

D. Blagojevic, S. Dietz, F. Koroknai, T. Weber from CyberDanube
JSON
.