Back to the CVE list
CVE-2025-41749

Cross-site scripting in Phoenixcontact Fl Switch 2008f Firmware

CVSS score

7.1

EPSS probability

%0.7

Risk score

0.0

Published

10 mo ago

OverviewPublic Exploits (0)NewsroomVulnerability Timeline
Patch status has not yet been verified

Resmî kaynaklarda yeterli kanıt bulunamadı. Bu sonuç “yama yok” anlamına gelmez.

Impact on My Inventory

Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.

Checking session…

Vulnerability description

DayBreach CVE AI Research

CVE-2025-41749 has vendor, distribution, patch and security-source records on file. We can compare them and prepare an explanation linked to the evidence.

An XSS vulnerability in port_util.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.

IMPACT: Affected Products and Software

Affected Products

The following products are affected by CVE-2025-41749 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.

IDVENDORPRODUCTACTION
1phoenixcontactfl switch 2008f firmware View
2phoenixcontactfl switch 2008f View
3phoenixcontactfl switch 2016 firmware View
4phoenixcontactfl switch 2016 View
5phoenixcontactfl switch 2105 firmware View
6phoenixcontactfl switch 2105 View
7phoenixcontactfl switch 2108 firmware View
8phoenixcontactfl switch 2108 View
9phoenixcontactfl switch 2116 firmware View
10phoenixcontactfl switch 2116 View
11phoenixcontactfl switch 2204-2tc-2sfx firmware View
12phoenixcontactfl switch 2204-2tc-2sfx View
13phoenixcontactfl switch 2205 firmware View
14phoenixcontactfl switch 2205 View
15phoenixcontactfl switch 2206-2fx firmware View
16phoenixcontactfl switch 2206-2fx View
17phoenixcontactfl switch 2206-2fx sm firmware View
18phoenixcontactfl switch 2206-2fx sm View
19phoenixcontactfl switch 2206-2fx sm st firmware View
20phoenixcontactfl switch 2206-2fx sm st View
21phoenixcontactfl switch 2206-2fx st firmware View
22phoenixcontactfl switch 2206-2fx st View
23phoenixcontactfl switch 2206-2sfx firmware View
24phoenixcontactfl switch 2206-2sfx View
25phoenixcontactfl switch 2206-2sfx pn firmware View
26phoenixcontactfl switch 2206-2sfx pn View
27phoenixcontactfl switch 2206c-2fx firmware View
28phoenixcontactfl switch 2206c-2fx View
29phoenixcontactfl switch 2207-fx firmware View
30phoenixcontactfl switch 2207-fx View
31phoenixcontactfl switch 2207-fx sm firmware View
32phoenixcontactfl switch 2207-fx sm View
33phoenixcontactfl switch 2208 firmware View
34phoenixcontactfl switch 2208 View
35phoenixcontactfl switch 2208 pn firmware View
36phoenixcontactfl switch 2208 pn View
37phoenixcontactfl switch 2208c firmware View
38phoenixcontactfl switch 2208c View
39phoenixcontactfl switch 2212-2tc-2sfx firmware View
40phoenixcontactfl switch 2212-2tc-2sfx View
41phoenixcontactfl switch 2214-2fx firmware View
42phoenixcontactfl switch 2214-2fx View
43phoenixcontactfl switch 2214-2fx sm firmware View
44phoenixcontactfl switch 2214-2fx sm View
45phoenixcontactfl switch 2214-2sfx firmware View
46phoenixcontactfl switch 2214-2sfx View
47phoenixcontactfl switch 2214-2sfx pn firmware View
48phoenixcontactfl switch 2214-2sfx pn View
49phoenixcontactfl switch 2216 firmware View
50phoenixcontactfl switch 2216 View
51phoenixcontactfl switch 2216 pn firmware View
52phoenixcontactfl switch 2216 pn View
53phoenixcontactfl switch 2303-8sp1 View
54phoenixcontactfl switch 2303-8sp1 View
55phoenixcontactfl switch 2304-2gc-2sfp firmware View
56phoenixcontactfl switch 2304-2gc-2sfp View
57phoenixcontactfl switch 2306-2sfp firmware View
58phoenixcontactfl switch 2306-2sfp View
59phoenixcontactfl switch 2306-2sfp pn firmware View
60phoenixcontactfl switch 2306-2sfp pn View
61phoenixcontactfl switch 2308 firmware View
62phoenixcontactfl switch 2308 View
63phoenixcontactfl switch 2308 pn firmware View
64phoenixcontactfl switch 2308 pn View
65phoenixcontactfl switch 2312-2gc-2sfp firmware View
66phoenixcontactfl switch 2312-2gc-2sfp View
67phoenixcontactfl switch 2314-2sfp firmware View
68phoenixcontactfl switch 2314-2sfp View
69phoenixcontactfl switch 2314-2sfp pn firmware View
70phoenixcontactfl switch 2314-2sfp pn View
71phoenixcontactfl switch 2316 firmware View
72phoenixcontactfl switch 2316 View
73phoenixcontactfl switch 2316/k1 firmware View
74phoenixcontactfl switch 2316/k1 View
75phoenixcontactfl switch 2316 pn firmware View
76phoenixcontactfl switch 2316 pn View
77phoenixcontactfl switch 2404-2tc-2sfx firmware View
78phoenixcontactfl switch 2404-2tc-2sfx View
79phoenixcontactfl switch 2406-2sfx firmware View
80phoenixcontactfl switch 2406-2sfx View
81phoenixcontactfl nat 2008 firmware View
82phoenixcontactfl nat 2008 View
83phoenixcontactfl nat 2208 firmware View
84phoenixcontactfl nat 2208 View
85phoenixcontactfl nat 2304-2gc-2sfp firmware View
86phoenixcontactfl nat 2304-2gc-2sfp View
87phoenixcontactfl switch 2005 firmware View
88phoenixcontactfl switch 2005 View
89phoenixcontactfl switch 2008 firmware View
90phoenixcontactfl switch 2008 View
91phoenixcontactfl switch 2406-2sfx pn firmware View
92phoenixcontactfl switch 2406-2sfx pn View
93phoenixcontactfl switch 2408 firmware View
94phoenixcontactfl switch 2408 View
95phoenixcontactfl switch 2408 pn firmware View
96phoenixcontactfl switch 2408 pn View
97phoenixcontactfl switch 2412-2tc-2sfx firmware View
98phoenixcontactfl switch 2412-2tc-2sfx View
99phoenixcontactfl switch 2414-2sfx firmware View
100phoenixcontactfl switch 2414-2sfx View
101phoenixcontactfl switch 2414-2sfx pn firmware View
102phoenixcontactfl switch 2414-2sfx pn View
103phoenixcontactfl switch 2416 firmware View
104phoenixcontactfl switch 2416 View
105phoenixcontactfl switch 2416 pn firmware View
106phoenixcontactfl switch 2416 pn View
107phoenixcontactfl switch 2504-2gc-2sfp firmware View
108phoenixcontactfl switch 2504-2gc-2sfp View
109phoenixcontactfl switch 2506-2sfp firmware View
110phoenixcontactfl switch 2506-2sfp View
111phoenixcontactfl switch 2506-2sfp/k1 firmware View
112phoenixcontactfl switch 2506-2sfp/k1 View
113phoenixcontactfl switch 2506-2sfp pn firmware View
114phoenixcontactfl switch 2506-2sfp pn View
115phoenixcontactfl switch 2508 firmware View
116phoenixcontactfl switch 2508 View
117phoenixcontactfl switch 2508/k1 firmware View
118phoenixcontactfl switch 2508/k1 View
119phoenixcontactfl switch 2508 pn firmware View
120phoenixcontactfl switch 2508 pn View
121phoenixcontactfl switch 2512-2gc-2sfp firmware View
122phoenixcontactfl switch 2512-2gc-2sfp View
123phoenixcontactfl switch 2514-2sfp firmware View
124phoenixcontactfl switch 2514-2sfp View
125phoenixcontactfl switch 2514-2sfp pn firmware View
126phoenixcontactfl switch 2514-2sfp pn View
127phoenixcontactfl switch 2516 firmware View
128phoenixcontactfl switch 2516 View
129phoenixcontactfl switch 2516 pn firmware View
130phoenixcontactfl switch 2516 pn View
131phoenixcontactfl switch 2608 firmware View
132phoenixcontactfl switch 2608 View
133phoenixcontactfl switch 2608 pn firmware View
134phoenixcontactfl switch 2608 pn View
135phoenixcontactfl switch 2708 firmware View
136phoenixcontactfl switch 2708 View
137phoenixcontactfl switch 2708 pn firmware View
138phoenixcontactfl switch 2708 pn View
Total affected vendors: 1|Products: 138

RED HAT CSAF/VEX: Product Impact Check

Red Hat has not yet published a CSAF/VEX impact record for this CVE. This does not mean “not affected”.

SCORING: CVSS from Multiple Sources

CVSS Scores

The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.

SCOREVERSIONSEVERITYVECTORSOURCE
7.1CVSS V31HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:LNVD

Patch and Remediation Guide

Solution & Remediation Advisory

Patch status unknown

İncelenen resmî kaynaklarda yama durumu doğrulanamadı. Bu sonuç “yama yok” anlamına gelmez.

Confirm the affected product and version against the source evidence above.
Restrict access to internet-facing services and apply network segmentation.
Until a patch is confirmed, follow the vendor advisory; do not read an unknown status as “no patch”.
Monitor server logs and network endpoints for signs of anomalous execution.

Public exploit and active exploitation status

Verified exploit intelligence

No verified public PoC, exploit repository or Metasploit module has been found for this CVE yet.

Weakness Classification and Attack Patterns (CWE & CAPEC)

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-41749 is associated with the following CWEs:

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-41749 weaknesses.

CAPEC-66: SQL InjectionCAPEC-126: Path TraversalCAPEC-28: OS Command Injection

Attack Vector and Accessibility

ExposureAğ üzerinden
PermissionsGerekmiyor
UserGerekiyor

Official Sources and Advisories

https://certvde.com/de/advisories/VDE-2025-071vendor-advisory

CVSS Vector Radar Chart

7.1 / 10
Attack VectorNetworkComplexityLowPrivilegesNoneUser Interact.RequiredConfidentialityLowIntegrityLowAvailabilityLow

Vulnerability Scoring Details

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone required
User Interaction—
Confidentiality (Gizlilik)Low
Integrity (Bütünlük)Low
Availability (Erişilebilirlik)Low

Yama durumu bilinmiyor

İncelenen resmî kaynaklarda yama durumu doğrulanamadı. Bu sonuç “yama yok” anlamına gelmez.

Follow the vendor

P
phoenixcontact logo
phoenixcontact

Weakness Type (CWE & CAPEC)

CWE-79

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.enginteksut.com.tr/api/v1/intel/cves/CVE-2025-41749"