XSS Vulnerability in Web Management Interface of Affected Product by Vendor
CVE-2025-41749

7.1HIGH

Key Information:

Vendor

Phoenix Contact

Status
Fl Switch 2005
Fl Switch 2008
Fl Switch 2016
Fl Switch 2105
Vendor
CVE Published:
9 December 2025

What is CVE-2025-41749?

An XSS vulnerability exists in the port_util.php file, allowing unauthenticated remote attackers to manipulate web application parameters by tricking authenticated users into clicking malicious links. While this vulnerability does not grant access to confidential system-level resources, it poses a risk to device configuration through the web management interface. The session cookie is protected with the httpOnly flag, providing a level of security against session takeover by attackers.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

FL NAT 2008 0.0.0 < 3.50

FL NAT 2208 0.0.0 < 3.50

FL NAT 2304-2GC-2SFP 0.0.0 < 3.50

References

https://certvde.com/de/advisories/VDE-2025-071

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

D. Blagojevic, S. Dietz, F. Koroknai, T. Weber from CyberDanube
JSON
.