CVE-2025-41697Medium· 6.8▾ SunlitAn attacker can use an undocumented UART port on the PCB as a side-channel to get root access e.g. with the credentials obtained from CVE-2025-41692.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 37.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
An attacker can use an undocumented UART port on the PCB as a side-channel to get root access e.g. with the credentials obtained from CVE-2025-41692.
fl_switch_2708_pn_firmware < 3.50fl_switch_2708_firmware < 3.50fl_switch_2608_pn_firmware < 3.50fl_switch_2608_firmware < 3.50fl_switch_2516_pn_firmware < 3.50fl_switch_2516_firmware < 3.50fl_switch_2514-2sfp_pn_firmware < 3.50fl_switch_2514-2sfp_firmware < 3.50fl_switch_2512-2gc-2sfp_firmware < 3.50fl_switch_2508_pn_firmware < 3.50fl_switch_2508/k1_firmware < 3.50fl_switch_2508_firmware < 3.50fl_switch_2506-2sfp_pn_firmware < 3.50fl_switch_2506-2sfp/k1_firmware < 3.50fl_switch_2506-2sfp_firmware < 3.50fl_switch_2504-2gc-2sfp_firmware < 3.50fl_switch_2416_pn_firmware < 3.50fl_switch_2416_firmware < 3.50fl_switch_2414-2sfx_pn_firmware < 3.50fl_switch_2414-2sfx_firmware < 3.50fl_switch_2412-2tc-2sfx_firmware < 3.50fl_switch_2408_pn_firmware < 3.50fl_switch_2408_firmware < 3.50fl_switch_2406-2sfx_pn_firmware < 3.50fl_switch_2406-2sfx_firmware < 3.50fl_switch_2404-2tc-2sfx_firmware < 3.50fl_switch_2316_pn_firmware < 3.50fl_switch_2316/k1_firmware < 3.50fl_switch_2316_firmware < 3.50fl_switch_2314-2sfp_pn_firmware < 3.50fl_switch_2314-2sfp_firmware < 3.50fl_switch_2312-2gc-2sfp_firmware < 3.50fl_switch_2308_pn_firmware < 3.50fl_switch_2308_firmware < 3.50fl_switch_2306-2sfp_pn_firmware < 3.50fl_switch_2306-2sfp_firmware < 3.50fl_switch_2304-2gc-2sfp_firmware < 3.50fl_switch_2303-8sp1 < 3.50fl_switch_2216_pn_firmware < 3.50fl_switch_2216_firmware < 3.50fl_switch_2214-2sfx_pn_firmware < 3.50fl_switch_2214-2sfx_firmware < 3.50fl_switch_2214-2fx_sm_firmware < 3.50fl_switch_2214-2fx_firmware < 3.50fl_switch_2212-2tc-2sfx_firmware < 3.50fl_switch_2208c_firmware < 3.50fl_switch_2208_pn_firmware < 3.50fl_switch_2208_firmware < 3.50fl_switch_2207-fx_sm_firmware < 3.50fl_switch_2207-fx_firmware < 3.50fl_switch_2206c-2fx_firmware < 3.50fl_switch_2206-2sfx_pn_firmware < 3.50fl_switch_2206-2sfx_firmware < 3.50fl_switch_2206-2fx_st_firmware < 3.50fl_switch_2206-2fx_sm_st_firmware < 3.50fl_switch_2206-2fx_sm_firmware < 3.50fl_switch_2206-2fx_firmware < 3.50fl_switch_2205_firmware < 3.50fl_switch_2204-2tc-2sfx_firmware < 3.50fl_switch_2116_firmware < 3.50fl_switch_2108_firmware < 3.50fl_switch_2105_firmware < 3.50fl_switch_2016_firmware < 3.50fl_switch_2008f_firmware < 3.50fl_switch_2008_firmware < 3.50fl_switch_2005_firmware < 3.50fl_nat_2304-2gc-2sfp_firmware < 3.50fl_nat_2208_firmware < 3.50fl_nat_2008_firmware < 3.50Upgrade past the affected range:
fl_switch_2708_pn_firmware 3.50fl_switch_2708_firmware 3.50fl_switch_2608_pn_firmware 3.50fl_switch_2608_firmware 3.50fl_switch_2516_pn_firmware 3.50fl_switch_2516_firmware 3.50fl_switch_2514-2sfp_pn_firmware 3.50fl_switch_2514-2sfp_firmware 3.50fl_switch_2512-2gc-2sfp_firmware 3.50fl_switch_2508_pn_firmware 3.50fl_switch_2508/k1_firmware 3.50fl_switch_2508_firmware 3.50fl_switch_2506-2sfp_pn_firmware 3.50fl_switch_2506-2sfp/k1_firmware 3.50fl_switch_2506-2sfp_firmware 3.50fl_switch_2504-2gc-2sfp_firmware 3.50fl_switch_2416_pn_firmware 3.50fl_switch_2416_firmware 3.50fl_switch_2414-2sfx_pn_firmware 3.50fl_switch_2414-2sfx_firmware 3.50fl_switch_2412-2tc-2sfx_firmware 3.50fl_switch_2408_pn_firmware 3.50fl_switch_2408_firmware 3.50fl_switch_2406-2sfx_pn_firmware 3.50fl_switch_2406-2sfx_firmware 3.50fl_switch_2404-2tc-2sfx_firmware 3.50fl_switch_2316_pn_firmware 3.50fl_switch_2316/k1_firmware 3.50fl_switch_2316_firmware 3.50fl_switch_2314-2sfp_pn_firmware 3.50fl_switch_2314-2sfp_firmware 3.50fl_switch_2312-2gc-2sfp_firmware 3.50fl_switch_2308_pn_firmware 3.50fl_switch_2308_firmware 3.50fl_switch_2306-2sfp_pn_firmware 3.50fl_switch_2306-2sfp_firmware 3.50fl_switch_2304-2gc-2sfp_firmware 3.50fl_switch_2303-8sp1 3.50fl_switch_2216_pn_firmware 3.50fl_switch_2216_firmware 3.50fl_switch_2214-2sfx_pn_firmware 3.50fl_switch_2214-2sfx_firmware 3.50fl_switch_2214-2fx_sm_firmware 3.50fl_switch_2214-2fx_firmware 3.50fl_switch_2212-2tc-2sfx_firmware 3.50fl_switch_2208c_firmware 3.50fl_switch_2208_pn_firmware 3.50fl_switch_2208_firmware 3.50fl_switch_2207-fx_sm_firmware 3.50fl_switch_2207-fx_firmware 3.50fl_switch_2206c-2fx_firmware 3.50fl_switch_2206-2sfx_pn_firmware 3.50fl_switch_2206-2sfx_firmware 3.50fl_switch_2206-2fx_st_firmware 3.50fl_switch_2206-2fx_sm_st_firmware 3.50fl_switch_2206-2fx_sm_firmware 3.50fl_switch_2206-2fx_firmware 3.50fl_switch_2205_firmware 3.50fl_switch_2204-2tc-2sfx_firmware 3.50fl_switch_2116_firmware 3.50fl_switch_2108_firmware 3.50fl_switch_2105_firmware 3.50fl_switch_2016_firmware 3.50fl_switch_2008f_firmware 3.50fl_switch_2008_firmware 3.50fl_switch_2005_firmware 3.50fl_nat_2304-2gc-2sfp_firmware 3.50fl_nat_2208_firmware 3.50fl_nat_2008_firmware 3.50Connected by shared product, vendor, weakness, or advisory.
CVE-2025-41694Medium· 6.5A low privileged remote attacker can run the webshell with an empty command containing whitespace
CVE-2025-41696Medium· 4.6An attacker can use an undocumented UART port on the PCB as a side-channel with the user hardcoded credentials obtained from CVE-2025-41692 to gain read access to parts of the filesystem of the device.
CVE-2025-41692Medium· 6.8A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak password generation algorithm.
CVE-2025-41693Medium· 4.3A low privileged remote attacker can use the ssh feature to execute commands directly after login
CVE-2025-41751High· 7.1An XSS vulnerability in pxc_portCntr.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM…
CVE-2025-41750High· 7.1An XSS vulnerability in pxc_PortCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM)…