High · published December 9, 2025
⚡ An unauthenticated attacker can be surprisingly crafty with a single POST request! This XSS vulnerability in pxc_portSecCfg.php lets them play puppet master with device configuration parameters. 🎭 Think of it like a remote chef manipulating a diner’s order by sending a phony request to the kitchen — they can change what’s served without ever stepping foot in the restaurant! This vulnerability could allow malicious users to tamper with crucial device settings, potentially leading to configuration mishaps that could affect the device's performance. While they can’t access sensitive system-level resources, the misconfiguration could still create a vulnerability that affects network security and device functionality.
Think of it like a remote chef manipulating a diner’s order by sending a phony request to the kitchen — they can change what’s served without ever stepping foot in the restaurant! The XSS vulnerability allows an attacker to trick an authenticated user into sending a manipulated POST request to the device via web management, altering its settings without proper authentication checks in place.
This vulnerability could allow malicious users to tamper with crucial device settings, potentially leading to configuration mishaps that could affect the device's performance. While they can’t access sensitive system-level resources, the misconfiguration could still create a vulnerability that affects network security and device functionality. To mitigate this vulnerability, ensure that you implement input validation and sanitization measures on all web inputs. Additionally, consider adding security features like Content Security Policy (CSP) and XSS protection headers. Regularly update your systems to the latest version to protect against known vulnerabilities. You've got this! By following these actions, you'll bolster your defenses and keep your devices secure. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| phoenixcontact/fl_switch_2406-2sfx_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2408_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2408_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2412-2tc-2sfx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2414-2sfx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2414-2sfx_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2416_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2416_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2504-2gc-2sfp_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2506-2sfp_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2506-2sfp\/k1_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2506-2sfp_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2508_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2508\/k1_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2508_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2512-2gc-2sfp_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2514-2sfp_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2514-2sfp_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2516_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2516_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2608_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2608_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2708_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2708_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_nat_2008_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_nat_2208_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_nat_2304-2gc-2sfp_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2005_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2008_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2008f_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2016_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2105_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2108_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2116_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2204-2tc-2sfx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2205_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2206-2fx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2206-2fx_sm_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2206-2fx_sm_st_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2206-2fx_st_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2206-2sfx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2206-2sfx_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2206c-2fx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2207-fx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2207-fx_sm_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2208_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2208_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2208c_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2212-2tc-2sfx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2214-2fx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2214-2fx_sm_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2214-2sfx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2214-2sfx_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2216_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2216_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2303-8sp1 | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2304-2gc-2sfp_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2306-2sfp_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2306-2sfp_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2308_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2308_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2312-2gc-2sfp_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2314-2sfp_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2314-2sfp_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2316_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2316\/k1_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2316_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2404-2tc-2sfx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2406-2sfx_firmware | < 3.50 | 3.50 |