CVE-2025-41750Network attack vector

Configuration changes via reflected XSS

Published Dec 9, 2025 · Updated Dec 9, 2025

Reflected XSS in pxc_PortCfg.php in Phoenix Contact FL SWITCH and FL NAT firmware before 3.50 allows remote attackers to alter WBM settings. The handler places attacker-controlled link input into a WBM response without neutralizing browser-executable content. An authenticated user must follow the crafted link; impact is confined to web-exposed configuration parameters, without session takeover or system-level access.

CVSS severity7.1
High
EPSS probability9.77%
Next 30 days · Sep 16, 2026
Known exploitationUnconfirmed
Based on sourced intelligence
Hinoki checkNot available
Coverage for this vulnerability

See if you're affected

Explore vulnerability checks for your environment with Hinoki.

Book a demo

Summary

What happened

Reflected XSS in pxc_PortCfg.php in Phoenix Contact FL SWITCH and FL NAT firmware before 3.50 allows remote attackers to alter WBM settings. The handler places attacker-controlled link input into a WBM response without neutralizing browser-executable content. An authenticated user must follow the crafted link; impact is confined to web-exposed configuration parameters, without session takeover or system-level access.

The record

CVE
CVE-2025-41750
Published
Dec 9, 2025
Updated
Dec 9, 2025
Vendor
Phoenix Contact
Product
FL SWITCH 2204-2TC-2SFX
Classifications
CWE-79, T1204.001, T1566.002
Attack vector
network
Privileges
unauthenticated

Timeline

How it unfolded

  1. Dec 9, 2025CVE publishedPublication date reported by the CVE source.
  2. Dec 9, 2025Record updatedLatest update available in the CVE record.

Exploitability

Present is not the same as exploitable

Compare your product and version with the public record. A matching version still requires validation against your environment.

Is a vulnerable build present?

Compare these published version ranges with your installed build and any vendor patches.

  1. Affected versionversion=0.0.0 <3.50

What conditions does exploitation require?

Attack vectornetwork
Required privilegesunauthenticated

What is affected?

Phoenix Contact · FL SWITCH 2204-2TC-2SFXversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2314-2SFPversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2306-2SFPversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2708 PNversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2514-2SFP PNversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2316version=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2212-2TC-2SFXversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2206-2FX SM STversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2214-2FXversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2214-2SFXversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2105version=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2208Cversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2108version=0.0.0 <3.50
Phoenix Contact · FL NAT 2008version=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2206-2SFX PNversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2314-2SFP PNversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2208 PNversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2116version=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2216version=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2414-2SFXversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2608version=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2508/K1version=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2408version=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2508 PNversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2506-2SFP/K1version=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2406-2SFXversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2306-2SFP PNversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2206C-2FXversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2416 PNversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2304-2GC-2SFPversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2416version=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2412-2TC-2SFXversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2214-2FX SMversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2207-FX SMversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2206-2FX STversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2308version=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2207-FXversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2516version=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2316 PNversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2216 PNversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2414-2SFX PNversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2214-2SFX PNversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2408 PNversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2514-2SFPversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2206-2FXversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2516 PNversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2205version=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2303-8SP1version=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2206-2FX SMversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2208version=0.0.0 <3.50
Phoenix Contact · FL NAT 2304-2GC-2SFPversion=0.0.0 <3.50
Phoenix Contact · FL NAT 2208version=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2008Fversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2506-2SFP PNversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2508version=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2404-2TC-2SFXversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2312-2GC-2SFPversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2008version=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2504-2GC-2SFPversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2308 PNversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2608 PNversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2016version=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2708version=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2316/K1version=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2206-2SFXversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2512-2GC-2SFPversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2506-2SFPversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2406-2SFX PNversion=0.0.0 <3.50
Phoenix Contact · FL SWITCH 2005version=0.0.0 <3.50

Published CVSS scores

7.1CERT VDECVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CVSS describes severity. EPSS estimates exploitation probability.

Attacks

What attackers are doing with it

Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.

Daily unique IPsNo honeypot observations are available for this CVE in the selected window.

No observations available

Sep 10, 2026Sep 16, 2026
Latest reporting daySep 16, 2026
Latest daily unique IPsUnavailable
Prior 30-day averageUnavailable
SourceShadowserver honeypots (KEV)
Vectornetwork
Privilegesunauthenticated
Known exploitationUnconfirmed
Public exploitUnconfirmed

Weakness, pattern, technique

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
T1204.001User Execution Malicious Link
T1566.002Spearphishing Link

Public exploit references

No public exploit references are available in this record.

Labels summarize the accepted research assessment. They do not indicate a test against your environment.

Technologies

Your stack

See the directory against your own environment.

Your stack

Check the software in your environment

Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.

Book a demo