Phoenixcontact Fl Switch 2105
15 CVEs affecting Phoenixcontact Fl Switch 2105. Latest disclosed: 2025-12-09. Critical: 0, High: 10.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-22509 | High | 8.8 | 2022-02-02 | In Phoenix Contact FL SWITCH Series 2xxx in version 3.00 an incorrect privilege assignment allows an low privileged user to enable full access to the device co… |
CVE-2025-41752 | High | 7.1 | 2025-12-09 | An XSS vulnerability in pxc_portSfp.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the a… |
CVE-2025-41751 | High | 7.1 | 2025-12-09 | An XSS vulnerability in pxc_portCntr.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the… |
CVE-2025-41750 | High | 7.1 | 2025-12-09 | An XSS vulnerability in pxc_PortCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the a… |
CVE-2025-41749 | High | 7.1 | 2025-12-09 | An XSS vulnerability in port_util.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the att… |
CVE-2025-41748 | High | 7.1 | 2025-12-09 | An XSS vulnerability in pxc_Dot1xCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the… |
CVE-2025-41747 | High | 7.1 | 2025-12-09 | An XSS vulnerability in pxc_vlanIntfCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request… |
CVE-2025-41746 | High | 7.1 | 2025-12-09 | An XSS vulnerability in pxc_portSecCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request… |
CVE-2025-41745 | High | 7.1 | 2025-12-09 | An XSS vulnerability in pxc_portCntr2.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request t… |
CVE-2025-41695 | High | 7.1 | 2025-12-09 | An XSS vulnerability in dyn_conn.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the… |
CVE-2025-41697 | Medium | 6.8 | 2025-12-09 | An attacker can use an undocumented UART port on the PCB as a side-channel to get root access e.g. with the credentials obtained from CVE-2025-41692. |
CVE-2025-41692 | Medium | 6.8 | 2025-12-09 | A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak passwo… |
CVE-2025-41694 | Medium | 6.5 | 2025-12-09 | A low privileged remote attacker can run the webshell with an empty command containing whitespace. The server will then block until it receives more data, resu… |
CVE-2025-41696 | Medium | 4.6 | 2025-12-09 | An attacker can use an undocumented UART port on the PCB as a side-channel with the user hardcoded credentials obtained from CVE-2025-41692 to gain read access… |
CVE-2025-41693 | Medium | 4.3 | 2025-12-09 | A low privileged remote attacker can use the ssh feature to execute commands directly after login. The process stays open and uses resources which leads to a r… |