{"id":"CVE-2025-41747","title":"An XSS vulnerability in pxc_vlanIntfCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based managemen…","summary":"An XSS vulnerability in pxc_vlanIntfCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based managemen…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cwe":["CWE-79"],"vendor":"phoenixcontact","product":"fl_nat_2008_firmware","affected":["fl_nat_2008_firmware < 3.50","fl_nat_2208_firmware < 3.50","fl_nat_2304-2gc-2sfp_firmware < 3.50","fl_switch_2005_firmware < 3.50","fl_switch_2008_firmware < 3.50","fl_switch_2008f_firmware < 3.50","fl_switch_2016_firmware < 3.50","fl_switch_2105_firmware < 3.50","fl_switch_2108_firmware < 3.50","fl_switch_2116_firmware < 3.50","fl_switch_2204-2tc-2sfx_firmware < 3.50","fl_switch_2205_firmware < 3.50","fl_switch_2206-2fx_firmware < 3.50","fl_switch_2206-2fx_sm_firmware < 3.50","fl_switch_2206-2fx_sm_st_firmware < 3.50","fl_switch_2206-2fx_st_firmware < 3.50","fl_switch_2206-2sfx_firmware < 3.50","fl_switch_2206-2sfx_pn_firmware < 3.50","fl_switch_2206c-2fx_firmware < 3.50","fl_switch_2207-fx_firmware < 3.50","fl_switch_2207-fx_sm_firmware < 3.50","fl_switch_2208_firmware < 3.50","fl_switch_2208_pn_firmware < 3.50","fl_switch_2208c_firmware < 3.50","fl_switch_2212-2tc-2sfx_firmware < 3.50","fl_switch_2214-2fx_firmware < 3.50","fl_switch_2214-2fx_sm_firmware < 3.50","fl_switch_2214-2sfx_firmware < 3.50","fl_switch_2214-2sfx_pn_firmware < 3.50","fl_switch_2216_firmware < 3.50","fl_switch_2216_pn_firmware < 3.50","fl_switch_2303-8sp1 < 3.50","fl_switch_2304-2gc-2sfp_firmware < 3.50","fl_switch_2306-2sfp_firmware < 3.50","fl_switch_2306-2sfp_pn_firmware < 3.50","fl_switch_2308_firmware < 3.50","fl_switch_2308_pn_firmware < 3.50","fl_switch_2312-2gc-2sfp_firmware < 3.50","fl_switch_2314-2sfp_firmware < 3.50","fl_switch_2314-2sfp_pn_firmware < 3.50","fl_switch_2316_firmware < 3.50","fl_switch_2316/k1_firmware < 3.50","fl_switch_2316_pn_firmware < 3.50","fl_switch_2404-2tc-2sfx_firmware < 3.50","fl_switch_2406-2sfx_firmware < 3.50","fl_switch_2406-2sfx_pn_firmware < 3.50","fl_switch_2408_firmware < 3.50","fl_switch_2408_pn_firmware < 3.50","fl_switch_2412-2tc-2sfx_firmware < 3.50","fl_switch_2414-2sfx_firmware < 3.50","fl_switch_2414-2sfx_pn_firmware < 3.50","fl_switch_2416_firmware < 3.50","fl_switch_2416_pn_firmware < 3.50","fl_switch_2504-2gc-2sfp_firmware < 3.50","fl_switch_2506-2sfp_firmware < 3.50","fl_switch_2506-2sfp/k1_firmware < 3.50","fl_switch_2506-2sfp_pn_firmware < 3.50","fl_switch_2508_firmware < 3.50","fl_switch_2508/k1_firmware < 3.50","fl_switch_2508_pn_firmware < 3.50","fl_switch_2512-2gc-2sfp_firmware < 3.50","fl_switch_2514-2sfp_firmware < 3.50","fl_switch_2514-2sfp_pn_firmware < 3.50","fl_switch_2516_firmware < 3.50","fl_switch_2516_pn_firmware < 3.50","fl_switch_2608_firmware < 3.50","fl_switch_2608_pn_firmware < 3.50","fl_switch_2708_firmware < 3.50","fl_switch_2708_pn_firmware < 3.50"],"patched":["fl_nat_2008_firmware 3.50","fl_nat_2208_firmware 3.50","fl_nat_2304-2gc-2sfp_firmware 3.50","fl_switch_2005_firmware 3.50","fl_switch_2008_firmware 3.50","fl_switch_2008f_firmware 3.50","fl_switch_2016_firmware 3.50","fl_switch_2105_firmware 3.50","fl_switch_2108_firmware 3.50","fl_switch_2116_firmware 3.50","fl_switch_2204-2tc-2sfx_firmware 3.50","fl_switch_2205_firmware 3.50","fl_switch_2206-2fx_firmware 3.50","fl_switch_2206-2fx_sm_firmware 3.50","fl_switch_2206-2fx_sm_st_firmware 3.50","fl_switch_2206-2fx_st_firmware 3.50","fl_switch_2206-2sfx_firmware 3.50","fl_switch_2206-2sfx_pn_firmware 3.50","fl_switch_2206c-2fx_firmware 3.50","fl_switch_2207-fx_firmware 3.50","fl_switch_2207-fx_sm_firmware 3.50","fl_switch_2208_firmware 3.50","fl_switch_2208_pn_firmware 3.50","fl_switch_2208c_firmware 3.50","fl_switch_2212-2tc-2sfx_firmware 3.50","fl_switch_2214-2fx_firmware 3.50","fl_switch_2214-2fx_sm_firmware 3.50","fl_switch_2214-2sfx_firmware 3.50","fl_switch_2214-2sfx_pn_firmware 3.50","fl_switch_2216_firmware 3.50","fl_switch_2216_pn_firmware 3.50","fl_switch_2303-8sp1 3.50","fl_switch_2304-2gc-2sfp_firmware 3.50","fl_switch_2306-2sfp_firmware 3.50","fl_switch_2306-2sfp_pn_firmware 3.50","fl_switch_2308_firmware 3.50","fl_switch_2308_pn_firmware 3.50","fl_switch_2312-2gc-2sfp_firmware 3.50","fl_switch_2314-2sfp_firmware 3.50","fl_switch_2314-2sfp_pn_firmware 3.50","fl_switch_2316_firmware 3.50","fl_switch_2316/k1_firmware 3.50","fl_switch_2316_pn_firmware 3.50","fl_switch_2404-2tc-2sfx_firmware 3.50","fl_switch_2406-2sfx_firmware 3.50","fl_switch_2406-2sfx_pn_firmware 3.50","fl_switch_2408_firmware 3.50","fl_switch_2408_pn_firmware 3.50","fl_switch_2412-2tc-2sfx_firmware 3.50","fl_switch_2414-2sfx_firmware 3.50","fl_switch_2414-2sfx_pn_firmware 3.50","fl_switch_2416_firmware 3.50","fl_switch_2416_pn_firmware 3.50","fl_switch_2504-2gc-2sfp_firmware 3.50","fl_switch_2506-2sfp_firmware 3.50","fl_switch_2506-2sfp/k1_firmware 3.50","fl_switch_2506-2sfp_pn_firmware 3.50","fl_switch_2508_firmware 3.50","fl_switch_2508/k1_firmware 3.50","fl_switch_2508_pn_firmware 3.50","fl_switch_2512-2gc-2sfp_firmware 3.50","fl_switch_2514-2sfp_firmware 3.50","fl_switch_2514-2sfp_pn_firmware 3.50","fl_switch_2516_firmware 3.50","fl_switch_2516_pn_firmware 3.50","fl_switch_2608_firmware 3.50","fl_switch_2608_pn_firmware 3.50","fl_switch_2708_firmware 3.50","fl_switch_2708_pn_firmware 3.50"],"published":"2025-12-09","updated":"2026-09-30","sourceUpdated":"2026-09-30T20:10:00.247","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-41747","references":[{"url":"https://certvde.com/de/advisories/VDE-2025-071","label":"info@cert.vde.com"}],"tags":["nvd"],"epss":0.09765,"epssPercentile":0.95386,"ingestedAt":"2026-09-30T20:23:19.439Z","slug":"CVE-2025-41747","body":"## Overview\n\nAn XSS vulnerability in pxc_vlanIntfCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.\n\n## Affected\n\n- `fl_nat_2008_firmware < 3.50`\n- `fl_nat_2208_firmware < 3.50`\n- `fl_nat_2304-2gc-2sfp_firmware < 3.50`\n- `fl_switch_2005_firmware < 3.50`\n- `fl_switch_2008_firmware < 3.50`\n- `fl_switch_2008f_firmware < 3.50`\n- `fl_switch_2016_firmware < 3.50`\n- `fl_switch_2105_firmware < 3.50`\n- `fl_switch_2108_firmware < 3.50`\n- `fl_switch_2116_firmware < 3.50`\n- `fl_switch_2204-2tc-2sfx_firmware < 3.50`\n- `fl_switch_2205_firmware < 3.50`\n- `fl_switch_2206-2fx_firmware < 3.50`\n- `fl_switch_2206-2fx_sm_firmware < 3.50`\n- `fl_switch_2206-2fx_sm_st_firmware < 3.50`\n- `fl_switch_2206-2fx_st_firmware < 3.50`\n- `fl_switch_2206-2sfx_firmware < 3.50`\n- `fl_switch_2206-2sfx_pn_firmware < 3.50`\n- `fl_switch_2206c-2fx_firmware < 3.50`\n- `fl_switch_2207-fx_firmware < 3.50`\n- `fl_switch_2207-fx_sm_firmware < 3.50`\n- `fl_switch_2208_firmware < 3.50`\n- `fl_switch_2208_pn_firmware < 3.50`\n- `fl_switch_2208c_firmware < 3.50`\n- `fl_switch_2212-2tc-2sfx_firmware < 3.50`\n- `fl_switch_2214-2fx_firmware < 3.50`\n- `fl_switch_2214-2fx_sm_firmware < 3.50`\n- `fl_switch_2214-2sfx_firmware < 3.50`\n- `fl_switch_2214-2sfx_pn_firmware < 3.50`\n- `fl_switch_2216_firmware < 3.50`\n- `fl_switch_2216_pn_firmware < 3.50`\n- `fl_switch_2303-8sp1 < 3.50`\n- `fl_switch_2304-2gc-2sfp_firmware < 3.50`\n- `fl_switch_2306-2sfp_firmware < 3.50`\n- `fl_switch_2306-2sfp_pn_firmware < 3.50`\n- `fl_switch_2308_firmware < 3.50`\n- `fl_switch_2308_pn_firmware < 3.50`\n- `fl_switch_2312-2gc-2sfp_firmware < 3.50`\n- `fl_switch_2314-2sfp_firmware < 3.50`\n- `fl_switch_2314-2sfp_pn_firmware < 3.50`\n- `fl_switch_2316_firmware < 3.50`\n- `fl_switch_2316/k1_firmware < 3.50`\n- `fl_switch_2316_pn_firmware < 3.50`\n- `fl_switch_2404-2tc-2sfx_firmware < 3.50`\n- `fl_switch_2406-2sfx_firmware < 3.50`\n- `fl_switch_2406-2sfx_pn_firmware < 3.50`\n- `fl_switch_2408_firmware < 3.50`\n- `fl_switch_2408_pn_firmware < 3.50`\n- `fl_switch_2412-2tc-2sfx_firmware < 3.50`\n- `fl_switch_2414-2sfx_firmware < 3.50`\n- `fl_switch_2414-2sfx_pn_firmware < 3.50`\n- `fl_switch_2416_firmware < 3.50`\n- `fl_switch_2416_pn_firmware < 3.50`\n- `fl_switch_2504-2gc-2sfp_firmware < 3.50`\n- `fl_switch_2506-2sfp_firmware < 3.50`\n- `fl_switch_2506-2sfp/k1_firmware < 3.50`\n- `fl_switch_2506-2sfp_pn_firmware < 3.50`\n- `fl_switch_2508_firmware < 3.50`\n- `fl_switch_2508/k1_firmware < 3.50`\n- `fl_switch_2508_pn_firmware < 3.50`\n- `fl_switch_2512-2gc-2sfp_firmware < 3.50`\n- `fl_switch_2514-2sfp_firmware < 3.50`\n- `fl_switch_2514-2sfp_pn_firmware < 3.50`\n- `fl_switch_2516_firmware < 3.50`\n- `fl_switch_2516_pn_firmware < 3.50`\n- `fl_switch_2608_firmware < 3.50`\n- `fl_switch_2608_pn_firmware < 3.50`\n- `fl_switch_2708_firmware < 3.50`\n- `fl_switch_2708_pn_firmware < 3.50`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `fl_nat_2008_firmware 3.50`\n- `fl_nat_2208_firmware 3.50`\n- `fl_nat_2304-2gc-2sfp_firmware 3.50`\n- `fl_switch_2005_firmware 3.50`\n- `fl_switch_2008_firmware 3.50`\n- `fl_switch_2008f_firmware 3.50`\n- `fl_switch_2016_firmware 3.50`\n- `fl_switch_2105_firmware 3.50`\n- `fl_switch_2108_firmware 3.50`\n- `fl_switch_2116_firmware 3.50`\n- `fl_switch_2204-2tc-2sfx_firmware 3.50`\n- `fl_switch_2205_firmware 3.50`\n- `fl_switch_2206-2fx_firmware 3.50`\n- `fl_switch_2206-2fx_sm_firmware 3.50`\n- `fl_switch_2206-2fx_sm_st_firmware 3.50`\n- `fl_switch_2206-2fx_st_firmware 3.50`\n- `fl_switch_2206-2sfx_firmware 3.50`\n- `fl_switch_2206-2sfx_pn_firmware 3.50`\n- `fl_switch_2206c-2fx_firmware 3.50`\n- `fl_switch_2207-fx_firmware 3.50`\n- `fl_switch_2207-fx_sm_firmware 3.50`\n- `fl_switch_2208_firmware 3.50`\n- `fl_switch_2208_pn_firmware 3.50`\n- `fl_switch_2208c_firmware 3.50`\n- `fl_switch_2212-2tc-2sfx_firmware 3.50`\n- `fl_switch_2214-2fx_firmware 3.50`\n- `fl_switch_2214-2fx_sm_firmware 3.50`\n- `fl_switch_2214-2sfx_firmware 3.50`\n- `fl_switch_2214-2sfx_pn_firmware 3.50`\n- `fl_switch_2216_firmware 3.50`\n- `fl_switch_2216_pn_firmware 3.50`\n- `fl_switch_2303-8sp1 3.50`\n- `fl_switch_2304-2gc-2sfp_firmware 3.50`\n- `fl_switch_2306-2sfp_firmware 3.50`\n- `fl_switch_2306-2sfp_pn_firmware 3.50`\n- `fl_switch_2308_firmware 3.50`\n- `fl_switch_2308_pn_firmware 3.50`\n- `fl_switch_2312-2gc-2sfp_firmware 3.50`\n- `fl_switch_2314-2sfp_firmware 3.50`\n- `fl_switch_2314-2sfp_pn_firmware 3.50`\n- `fl_switch_2316_firmware 3.50`\n- `fl_switch_2316/k1_firmware 3.50`\n- `fl_switch_2316_pn_firmware 3.50`\n- `fl_switch_2404-2tc-2sfx_firmware 3.50`\n- `fl_switch_2406-2sfx_firmware 3.50`\n- `fl_switch_2406-2sfx_pn_firmware 3.50`\n- `fl_switch_2408_firmware 3.50`\n- `fl_switch_2408_pn_firmware 3.50`\n- `fl_switch_2412-2tc-2sfx_firmware 3.50`\n- `fl_switch_2414-2sfx_firmware 3.50`\n- `fl_switch_2414-2sfx_pn_firmware 3.50`\n- `fl_switch_2416_firmware 3.50`\n- `fl_switch_2416_pn_firmware 3.50`\n- `fl_switch_2504-2gc-2sfp_firmware 3.50`\n- `fl_switch_2506-2sfp_firmware 3.50`\n- `fl_switch_2506-2sfp/k1_firmware 3.50`\n- `fl_switch_2506-2sfp_pn_firmware 3.50`\n- `fl_switch_2508_firmware 3.50`\n- `fl_switch_2508/k1_firmware 3.50`\n- `fl_switch_2508_pn_firmware 3.50`\n- `fl_switch_2512-2gc-2sfp_firmware 3.50`\n- `fl_switch_2514-2sfp_firmware 3.50`\n- `fl_switch_2514-2sfp_pn_firmware 3.50`\n- `fl_switch_2516_firmware 3.50`\n- `fl_switch_2516_pn_firmware 3.50`\n- `fl_switch_2608_firmware 3.50`\n- `fl_switch_2608_pn_firmware 3.50`\n- `fl_switch_2708_firmware 3.50`\n- `fl_switch_2708_pn_firmware 3.50`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":39.1,"likelihood":2,"exploitation":0,"ransomware":0},"changes":[]}