{"id":"CVE-2025-41694","title":"A low privileged remote attacker can run the webshell with an empty command containing whitespace","summary":"A low privileged remote attacker can run the webshell with an empty command containing whitespace. The server will then block until it receives more data, resulting in a DoS condition of the websserver.","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-770"],"vendor":"phoenixcontact","product":"fl_switch_2708_pn_firmware","affected":["fl_switch_2708_pn_firmware < 3.50","fl_switch_2708_firmware < 3.50","fl_switch_2608_pn_firmware < 3.50","fl_switch_2608_firmware < 3.50","fl_switch_2516_pn_firmware < 3.50","fl_switch_2208c_firmware < 3.50","fl_switch_2208_pn_firmware < 3.50","fl_switch_2208_firmware < 3.50","fl_switch_2207-fx_sm_firmware < 3.50","fl_switch_2207-fx_firmware < 3.50","fl_switch_2206c-2fx_firmware < 3.50","fl_switch_2206-2sfx_pn_firmware < 3.50","fl_switch_2206-2sfx_firmware < 3.50","fl_switch_2206-2fx_st_firmware < 3.50","fl_switch_2206-2fx_sm_st_firmware < 3.50","fl_switch_2206-2fx_sm_firmware < 3.50","fl_switch_2206-2fx_firmware < 3.50","fl_switch_2205_firmware < 3.50","fl_switch_2204-2tc-2sfx_firmware < 3.50","fl_switch_2116_firmware < 3.50","fl_switch_2108_firmware < 3.50","fl_switch_2105_firmware < 3.50","fl_switch_2016_firmware < 3.50","fl_switch_2008f_firmware < 3.50","fl_switch_2008_firmware < 3.50","fl_switch_2005_firmware < 3.50","fl_nat_2304-2gc-2sfp_firmware < 3.50","fl_nat_2208_firmware < 3.50","fl_nat_2008_firmware < 3.50","fl_switch_2516_firmware < 3.50","fl_switch_2514-2sfp_pn_firmware < 3.50","fl_switch_2514-2sfp_firmware < 3.50","fl_switch_2512-2gc-2sfp_firmware < 3.50","fl_switch_2508_pn_firmware < 3.50","fl_switch_2508/k1_firmware < 3.50","fl_switch_2508_firmware < 3.50","fl_switch_2506-2sfp_pn_firmware < 3.50","fl_switch_2506-2sfp/k1_firmware < 3.50","fl_switch_2506-2sfp_firmware < 3.50","fl_switch_2504-2gc-2sfp_firmware < 3.50","fl_switch_2416_pn_firmware < 3.50","fl_switch_2416_firmware < 3.50","fl_switch_2414-2sfx_pn_firmware < 3.50","fl_switch_2414-2sfx_firmware < 3.50","fl_switch_2412-2tc-2sfx_firmware < 3.50","fl_switch_2408_pn_firmware < 3.50","fl_switch_2408_firmware < 3.50","fl_switch_2406-2sfx_pn_firmware < 3.50","fl_switch_2406-2sfx_firmware < 3.50","fl_switch_2404-2tc-2sfx_firmware < 3.50","fl_switch_2316_pn_firmware < 3.50","fl_switch_2316/k1_firmware < 3.50","fl_switch_2316_firmware < 3.50","fl_switch_2314-2sfp_pn_firmware < 3.50","fl_switch_2314-2sfp_firmware < 3.50","fl_switch_2312-2gc-2sfp_firmware < 3.50","fl_switch_2308_pn_firmware < 3.50","fl_switch_2308_firmware < 3.50","fl_switch_2306-2sfp_pn_firmware < 3.50","fl_switch_2306-2sfp_firmware < 3.50","fl_switch_2304-2gc-2sfp_firmware < 3.50","fl_switch_2303-8sp1 < 3.50","fl_switch_2216_pn_firmware < 3.50","fl_switch_2216_firmware < 3.50","fl_switch_2214-2sfx_pn_firmware < 3.50","fl_switch_2214-2sfx_firmware < 3.50","fl_switch_2214-2fx_sm_firmware < 3.50","fl_switch_2214-2fx_firmware < 3.50","fl_switch_2212-2tc-2sfx_firmware < 3.50"],"patched":["fl_switch_2708_pn_firmware 3.50","fl_switch_2708_firmware 3.50","fl_switch_2608_pn_firmware 3.50","fl_switch_2608_firmware 3.50","fl_switch_2516_pn_firmware 3.50","fl_switch_2208c_firmware 3.50","fl_switch_2208_pn_firmware 3.50","fl_switch_2208_firmware 3.50","fl_switch_2207-fx_sm_firmware 3.50","fl_switch_2207-fx_firmware 3.50","fl_switch_2206c-2fx_firmware 3.50","fl_switch_2206-2sfx_pn_firmware 3.50","fl_switch_2206-2sfx_firmware 3.50","fl_switch_2206-2fx_st_firmware 3.50","fl_switch_2206-2fx_sm_st_firmware 3.50","fl_switch_2206-2fx_sm_firmware 3.50","fl_switch_2206-2fx_firmware 3.50","fl_switch_2205_firmware 3.50","fl_switch_2204-2tc-2sfx_firmware 3.50","fl_switch_2116_firmware 3.50","fl_switch_2108_firmware 3.50","fl_switch_2105_firmware 3.50","fl_switch_2016_firmware 3.50","fl_switch_2008f_firmware 3.50","fl_switch_2008_firmware 3.50","fl_switch_2005_firmware 3.50","fl_nat_2304-2gc-2sfp_firmware 3.50","fl_nat_2208_firmware 3.50","fl_nat_2008_firmware 3.50","fl_switch_2516_firmware 3.50","fl_switch_2514-2sfp_pn_firmware 3.50","fl_switch_2514-2sfp_firmware 3.50","fl_switch_2512-2gc-2sfp_firmware 3.50","fl_switch_2508_pn_firmware 3.50","fl_switch_2508/k1_firmware 3.50","fl_switch_2508_firmware 3.50","fl_switch_2506-2sfp_pn_firmware 3.50","fl_switch_2506-2sfp/k1_firmware 3.50","fl_switch_2506-2sfp_firmware 3.50","fl_switch_2504-2gc-2sfp_firmware 3.50","fl_switch_2416_pn_firmware 3.50","fl_switch_2416_firmware 3.50","fl_switch_2414-2sfx_pn_firmware 3.50","fl_switch_2414-2sfx_firmware 3.50","fl_switch_2412-2tc-2sfx_firmware 3.50","fl_switch_2408_pn_firmware 3.50","fl_switch_2408_firmware 3.50","fl_switch_2406-2sfx_pn_firmware 3.50","fl_switch_2406-2sfx_firmware 3.50","fl_switch_2404-2tc-2sfx_firmware 3.50","fl_switch_2316_pn_firmware 3.50","fl_switch_2316/k1_firmware 3.50","fl_switch_2316_firmware 3.50","fl_switch_2314-2sfp_pn_firmware 3.50","fl_switch_2314-2sfp_firmware 3.50","fl_switch_2312-2gc-2sfp_firmware 3.50","fl_switch_2308_pn_firmware 3.50","fl_switch_2308_firmware 3.50","fl_switch_2306-2sfp_pn_firmware 3.50","fl_switch_2306-2sfp_firmware 3.50","fl_switch_2304-2gc-2sfp_firmware 3.50","fl_switch_2303-8sp1 3.50","fl_switch_2216_pn_firmware 3.50","fl_switch_2216_firmware 3.50","fl_switch_2214-2sfx_pn_firmware 3.50","fl_switch_2214-2sfx_firmware 3.50","fl_switch_2214-2fx_sm_firmware 3.50","fl_switch_2214-2fx_firmware 3.50","fl_switch_2212-2tc-2sfx_firmware 3.50"],"published":"2025-12-09","updated":"2026-09-30","sourceUpdated":"2026-09-30T20:10:00.247","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-41694","references":[{"url":"https://certvde.com/de/advisories/VDE-2025-071","label":"info@cert.vde.com"}],"tags":["nvd"],"epss":0.00482,"epssPercentile":0.39231,"ingestedAt":"2026-09-30T20:23:19.437Z","slug":"CVE-2025-41694","body":"## Overview\n\nA low privileged remote attacker can run the webshell with an empty command containing whitespace. The server will then block until it receives more data, resulting in a DoS condition of the websserver.\n\n## Affected\n\n- `fl_switch_2708_pn_firmware < 3.50`\n- `fl_switch_2708_firmware < 3.50`\n- `fl_switch_2608_pn_firmware < 3.50`\n- `fl_switch_2608_firmware < 3.50`\n- `fl_switch_2516_pn_firmware < 3.50`\n- `fl_switch_2208c_firmware < 3.50`\n- `fl_switch_2208_pn_firmware < 3.50`\n- `fl_switch_2208_firmware < 3.50`\n- `fl_switch_2207-fx_sm_firmware < 3.50`\n- `fl_switch_2207-fx_firmware < 3.50`\n- `fl_switch_2206c-2fx_firmware < 3.50`\n- `fl_switch_2206-2sfx_pn_firmware < 3.50`\n- `fl_switch_2206-2sfx_firmware < 3.50`\n- `fl_switch_2206-2fx_st_firmware < 3.50`\n- `fl_switch_2206-2fx_sm_st_firmware < 3.50`\n- `fl_switch_2206-2fx_sm_firmware < 3.50`\n- `fl_switch_2206-2fx_firmware < 3.50`\n- `fl_switch_2205_firmware < 3.50`\n- `fl_switch_2204-2tc-2sfx_firmware < 3.50`\n- `fl_switch_2116_firmware < 3.50`\n- `fl_switch_2108_firmware < 3.50`\n- `fl_switch_2105_firmware < 3.50`\n- `fl_switch_2016_firmware < 3.50`\n- `fl_switch_2008f_firmware < 3.50`\n- `fl_switch_2008_firmware < 3.50`\n- `fl_switch_2005_firmware < 3.50`\n- `fl_nat_2304-2gc-2sfp_firmware < 3.50`\n- `fl_nat_2208_firmware < 3.50`\n- `fl_nat_2008_firmware < 3.50`\n- `fl_switch_2516_firmware < 3.50`\n- `fl_switch_2514-2sfp_pn_firmware < 3.50`\n- `fl_switch_2514-2sfp_firmware < 3.50`\n- `fl_switch_2512-2gc-2sfp_firmware < 3.50`\n- `fl_switch_2508_pn_firmware < 3.50`\n- `fl_switch_2508/k1_firmware < 3.50`\n- `fl_switch_2508_firmware < 3.50`\n- `fl_switch_2506-2sfp_pn_firmware < 3.50`\n- `fl_switch_2506-2sfp/k1_firmware < 3.50`\n- `fl_switch_2506-2sfp_firmware < 3.50`\n- `fl_switch_2504-2gc-2sfp_firmware < 3.50`\n- `fl_switch_2416_pn_firmware < 3.50`\n- `fl_switch_2416_firmware < 3.50`\n- `fl_switch_2414-2sfx_pn_firmware < 3.50`\n- `fl_switch_2414-2sfx_firmware < 3.50`\n- `fl_switch_2412-2tc-2sfx_firmware < 3.50`\n- `fl_switch_2408_pn_firmware < 3.50`\n- `fl_switch_2408_firmware < 3.50`\n- `fl_switch_2406-2sfx_pn_firmware < 3.50`\n- `fl_switch_2406-2sfx_firmware < 3.50`\n- `fl_switch_2404-2tc-2sfx_firmware < 3.50`\n- `fl_switch_2316_pn_firmware < 3.50`\n- `fl_switch_2316/k1_firmware < 3.50`\n- `fl_switch_2316_firmware < 3.50`\n- `fl_switch_2314-2sfp_pn_firmware < 3.50`\n- `fl_switch_2314-2sfp_firmware < 3.50`\n- `fl_switch_2312-2gc-2sfp_firmware < 3.50`\n- `fl_switch_2308_pn_firmware < 3.50`\n- `fl_switch_2308_firmware < 3.50`\n- `fl_switch_2306-2sfp_pn_firmware < 3.50`\n- `fl_switch_2306-2sfp_firmware < 3.50`\n- `fl_switch_2304-2gc-2sfp_firmware < 3.50`\n- `fl_switch_2303-8sp1 < 3.50`\n- `fl_switch_2216_pn_firmware < 3.50`\n- `fl_switch_2216_firmware < 3.50`\n- `fl_switch_2214-2sfx_pn_firmware < 3.50`\n- `fl_switch_2214-2sfx_firmware < 3.50`\n- `fl_switch_2214-2fx_sm_firmware < 3.50`\n- `fl_switch_2214-2fx_firmware < 3.50`\n- `fl_switch_2212-2tc-2sfx_firmware < 3.50`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `fl_switch_2708_pn_firmware 3.50`\n- `fl_switch_2708_firmware 3.50`\n- `fl_switch_2608_pn_firmware 3.50`\n- `fl_switch_2608_firmware 3.50`\n- `fl_switch_2516_pn_firmware 3.50`\n- `fl_switch_2208c_firmware 3.50`\n- `fl_switch_2208_pn_firmware 3.50`\n- `fl_switch_2208_firmware 3.50`\n- `fl_switch_2207-fx_sm_firmware 3.50`\n- `fl_switch_2207-fx_firmware 3.50`\n- `fl_switch_2206c-2fx_firmware 3.50`\n- `fl_switch_2206-2sfx_pn_firmware 3.50`\n- `fl_switch_2206-2sfx_firmware 3.50`\n- `fl_switch_2206-2fx_st_firmware 3.50`\n- `fl_switch_2206-2fx_sm_st_firmware 3.50`\n- `fl_switch_2206-2fx_sm_firmware 3.50`\n- `fl_switch_2206-2fx_firmware 3.50`\n- `fl_switch_2205_firmware 3.50`\n- `fl_switch_2204-2tc-2sfx_firmware 3.50`\n- `fl_switch_2116_firmware 3.50`\n- `fl_switch_2108_firmware 3.50`\n- `fl_switch_2105_firmware 3.50`\n- `fl_switch_2016_firmware 3.50`\n- `fl_switch_2008f_firmware 3.50`\n- `fl_switch_2008_firmware 3.50`\n- `fl_switch_2005_firmware 3.50`\n- `fl_nat_2304-2gc-2sfp_firmware 3.50`\n- `fl_nat_2208_firmware 3.50`\n- `fl_nat_2008_firmware 3.50`\n- `fl_switch_2516_firmware 3.50`\n- `fl_switch_2514-2sfp_pn_firmware 3.50`\n- `fl_switch_2514-2sfp_firmware 3.50`\n- `fl_switch_2512-2gc-2sfp_firmware 3.50`\n- `fl_switch_2508_pn_firmware 3.50`\n- `fl_switch_2508/k1_firmware 3.50`\n- `fl_switch_2508_firmware 3.50`\n- `fl_switch_2506-2sfp_pn_firmware 3.50`\n- `fl_switch_2506-2sfp/k1_firmware 3.50`\n- `fl_switch_2506-2sfp_firmware 3.50`\n- `fl_switch_2504-2gc-2sfp_firmware 3.50`\n- `fl_switch_2416_pn_firmware 3.50`\n- `fl_switch_2416_firmware 3.50`\n- `fl_switch_2414-2sfx_pn_firmware 3.50`\n- `fl_switch_2414-2sfx_firmware 3.50`\n- `fl_switch_2412-2tc-2sfx_firmware 3.50`\n- `fl_switch_2408_pn_firmware 3.50`\n- `fl_switch_2408_firmware 3.50`\n- `fl_switch_2406-2sfx_pn_firmware 3.50`\n- `fl_switch_2406-2sfx_firmware 3.50`\n- `fl_switch_2404-2tc-2sfx_firmware 3.50`\n- `fl_switch_2316_pn_firmware 3.50`\n- `fl_switch_2316/k1_firmware 3.50`\n- `fl_switch_2316_firmware 3.50`\n- `fl_switch_2314-2sfp_pn_firmware 3.50`\n- `fl_switch_2314-2sfp_firmware 3.50`\n- `fl_switch_2312-2gc-2sfp_firmware 3.50`\n- `fl_switch_2308_pn_firmware 3.50`\n- `fl_switch_2308_firmware 3.50`\n- `fl_switch_2306-2sfp_pn_firmware 3.50`\n- `fl_switch_2306-2sfp_firmware 3.50`\n- `fl_switch_2304-2gc-2sfp_firmware 3.50`\n- `fl_switch_2303-8sp1 3.50`\n- `fl_switch_2216_pn_firmware 3.50`\n- `fl_switch_2216_firmware 3.50`\n- `fl_switch_2214-2sfx_pn_firmware 3.50`\n- `fl_switch_2214-2sfx_firmware 3.50`\n- `fl_switch_2214-2fx_sm_firmware 3.50`\n- `fl_switch_2214-2fx_firmware 3.50`\n- `fl_switch_2212-2tc-2sfx_firmware 3.50`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}