Phoenixcontact Fl Nat 2304-2gc-2sfp Firmware
15 CVEs affecting Phoenixcontact Fl Nat 2304-2gc-2sfp Firmware. Latest disclosed: 2025-12-09. Critical: 0, High: 10.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-18352 | High | 8.2 | 2020-02-18 | Improper access control exists on PHOENIX CONTACT FL NAT 2208 devices before V2.90 and FL NAT 2304-2GC-2SFP devices before V2.90 when using MAC-based port secu… |
CVE-2025-41752 | High | 7.1 | 2025-12-09 | An XSS vulnerability in pxc_portSfp.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the a… |
CVE-2025-41751 | High | 7.1 | 2025-12-09 | An XSS vulnerability in pxc_portCntr.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the… |
CVE-2025-41750 | High | 7.1 | 2025-12-09 | An XSS vulnerability in pxc_PortCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the a… |
CVE-2025-41749 | High | 7.1 | 2025-12-09 | An XSS vulnerability in port_util.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the att… |
CVE-2025-41748 | High | 7.1 | 2025-12-09 | An XSS vulnerability in pxc_Dot1xCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the… |
CVE-2025-41747 | High | 7.1 | 2025-12-09 | An XSS vulnerability in pxc_vlanIntfCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request… |
CVE-2025-41746 | High | 7.1 | 2025-12-09 | An XSS vulnerability in pxc_portSecCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request… |
CVE-2025-41745 | High | 7.1 | 2025-12-09 | An XSS vulnerability in pxc_portCntr2.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request t… |
CVE-2025-41695 | High | 7.1 | 2025-12-09 | An XSS vulnerability in dyn_conn.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the… |
CVE-2025-41697 | Medium | 6.8 | 2025-12-09 | An attacker can use an undocumented UART port on the PCB as a side-channel to get root access e.g. with the credentials obtained from CVE-2025-41692. |
CVE-2025-41692 | Medium | 6.8 | 2025-12-09 | A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak passwo… |
CVE-2025-41694 | Medium | 6.5 | 2025-12-09 | A low privileged remote attacker can run the webshell with an empty command containing whitespace. The server will then block until it receives more data, resu… |
CVE-2025-41696 | Medium | 4.6 | 2025-12-09 | An attacker can use an undocumented UART port on the PCB as a side-channel with the user hardcoded credentials obtained from CVE-2025-41692 to gain read access… |
CVE-2025-41693 | Medium | 4.3 | 2025-12-09 | A low privileged remote attacker can use the ssh feature to execute commands directly after login. The process stays open and uses resources which leads to a r… |