Phoenixcontact
Vulnerability activity for Phoenixcontact: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 15
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 8.0HighMay 7, 2026Phoenixcontact fl mguard 2102 firmware Information disclosureCVE-2024-43384A low privileged remote attacker can gain the root password due to improper removal of sensitive information before storage or transfer.
- 7.1HighDec 9, 2025Phoenixcontact fl nat 2008 firmware XSSCVE-2025-41752An XSS vulnerability in pxc_portSfp.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is 9.8% likelyDetection
- 7.1HighDec 9, 2025Phoenixcontact fl nat 2008 firmware XSSCVE-2025-41751An XSS vulnerability in pxc_portCntr.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is9.8% likelyDetection
- 7.1HighDec 9, 2025Phoenixcontact fl switch 2008f firmware XSSCVE-2025-41750An XSS vulnerability in pxc_PortCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is 9.8% likelyDetection
- 7.1HighDec 9, 2025Phoenixcontact fl switch 2008f firmware XSSCVE-2025-41749An XSS vulnerability in port_util.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is seDetection
- 7.1HighDec 9, 2025Phoenixcontact fl nat 2008 firmware XSSCVE-2025-41748An XSS vulnerability in pxc_Dot1xCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is9.8% likelyDetection
- 7.1HighDec 9, 2025Phoenixcontact fl nat 2008 firmware XSSCVE-2025-41747An XSS vulnerability in pxc_vlanIntfCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session coo9.8% likelyDetection
- 7.1HighDec 9, 2025Phoenixcontact fl switch 2406-2sfx pn firmware XSSCVE-2025-41746An XSS vulnerability in pxc_portSecCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cook9.8% likelyDetection
- 7.1HighDec 9, 2025Phoenixcontact fl nat 2008 firmware XSSCVE-2025-41745An XSS vulnerability in pxc_portCntr2.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookiDetection
- 6.8MediumDec 9, 2025Phoenixcontact fl switch 2708 pn firmwareCVE-2025-41697An attacker can use an undocumented UART port on the PCB as a side-channel to get root access e.g. with the credentials obtained from CVE-2025-41692.
- 4.6MediumDec 9, 2025Phoenixcontact fl switch 2708 pn firmware Auth bypass / access controlCVE-2025-41696An attacker can use an undocumented UART port on the PCB as a side-channel with the user hardcoded credentials obtained from CVE-2025-41692 to gain read access to parts of the filesystem of the device.
- 7.1HighDec 9, 2025Phoenixcontact fl nat 2008 firmware XSSCVE-2025-41695An XSS vulnerability in dyn_conn.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is Detection
- 6.5MediumDec 9, 2025Phoenixcontact fl switch 2708 pn firmware Denial of serviceCVE-2025-41694A low privileged remote attacker can run the webshell with an empty command containing whitespace. The server will then block until it receives more data, resulting in a DoS condition of the websserver.
- 4.3MediumDec 9, 2025Phoenixcontact fl switch 2708 pn firmware Denial of serviceCVE-2025-41693A low privileged remote attacker can use the ssh feature to execute commands directly after login. The process stays open and uses resources which leads to a reduced performance of the management functions. Switching functionality is not affected.
- 6.8MediumDec 9, 2025Phoenixcontact fl switch 2708 pn firmware Crypto / certificateCVE-2025-41692A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak password generation algorithm.
Top products
- fl nat 2008 firmware6 CVEs in the last year
- fl switch 2708 pn firmware5 CVEs in the last year
- fl switch 2008f firmware2 CVEs in the last year
- fl switch 2406-2sfx pn firmware1 CVE in the last year
- fl mguard 2102 firmware1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.