Phoenixcontact Fl Nat 2208 Firmware vulnerabilities

15 CVEs affecting Phoenixcontact Fl Nat 2208 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-41752, published 2025-12-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-41752, published 2025-12-09. High severity, CVSS 7.1. EPSS: 9.8% chance of exploitation in the next 30 days. An XSS vulnerability in pxc_portSfp.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters…
CVE-2025-41751, published 2025-12-09. High severity, CVSS 7.1. EPSS: 9.8% chance of exploitation in the next 30 days. An XSS vulnerability in pxc_portCntr.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters…
CVE-2025-41750, published 2025-12-09. High severity, CVSS 7.1. EPSS: 9.8% chance of exploitation in the next 30 days. An XSS vulnerability in pxc_PortCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters…
CVE-2025-41748, published 2025-12-09. High severity, CVSS 7.1. EPSS: 9.8% chance of exploitation in the next 30 days. An XSS vulnerability in pxc_Dot1xCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters…
CVE-2025-41747, published 2025-12-09. High severity, CVSS 7.1. EPSS: 9.8% chance of exploitation in the next 30 days. An XSS vulnerability in pxc_vlanIntfCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change…
CVE-2025-41746, published 2025-12-09. High severity, CVSS 7.1. EPSS: 9.8% chance of exploitation in the next 30 days. An XSS vulnerability in pxc_portSecCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change…
CVE-2025-41695, published 2025-12-09. High severity, CVSS 7.1. EPSS: 0.7% chance of exploitation in the next 30 days. An XSS vulnerability in dyn_conn.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters…
CVE-2025-41749, published 2025-12-09. High severity, CVSS 7.1. EPSS: 0.7% chance of exploitation in the next 30 days. An XSS vulnerability in port_util.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters…
CVE-2025-41745, published 2025-12-09. High severity, CVSS 7.1. EPSS: 0.7% chance of exploitation in the next 30 days. An XSS vulnerability in pxc_portCntr2.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change…
CVE-2025-41693, published 2025-12-09. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. A low privileged remote attacker can use the ssh feature to execute commands directly after login. The process stays open and uses resources which leads to a reduced performance of the management…

Latest

CVE-2025-41697, published 2025-12-09. Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days. An attacker can use an undocumented UART port on the PCB as a side-channel to get root access e.g. with the credentials obtained from CVE-2025-41692.
CVE-2025-41696, published 2025-12-09. Medium severity, CVSS 4.6. EPSS: 0.2% chance of exploitation in the next 30 days. An attacker can use an undocumented UART port on the PCB as a side-channel with the user hardcoded credentials obtained from CVE-2025-41692 to gain read access to parts of the filesystem of the…