Stack-Based Buffer Overflow in Device File Transfer Workflow from VDE
CVE-2026-22318

4.9MEDIUM

Key Information:

Vendor

Phoenix Contact

Status
Fl Switch 2005
Fl Switch 2008
Fl Switch 2016
Fl Switch 2105
Vendor
CVE Published:
18 March 2026

What is CVE-2026-22318?

A stack-based buffer overflow vulnerability in VDE's device file transfer parameter workflow enables a high-privileged attacker to exploit oversized POST parameters. This exploitation can lead to memory corruption within internal processes, resulting in denial-of-service (DoS) conditions that disrupt service availability.

Affected Version(s)

FL NAT 2008 0.0.0 < 3.53

FL NAT 2208 0.0.0 < 3.53

FL NAT 2304-2GC-2SFP 0.0.0 < 3.53

References

https://certvde.com/de/advisories/VDE-2025-104

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gabriele Quagliarella from Nozomi Networks
.