High · published December 9, 2025
⚡ An XSS vulnerability lurking in pxc_PortCfg.php allows attackers to play a cunning game of deception! 🎭 Think of it like a clever con artist convincing a person to change their bank account details over the phone, but only able to access their limited transaction settings and not their entire account. The attacker needs to trick the target into clicking a link to pull off this sneaky maneuver. If an attacker successfully tricks an authenticated user into clicking their malicious link, they can manipulate device configuration parameters through the web-based management system. While they can't directly access sensitive system-level resources, they could still cause significant disruption by altering configurations, potentially leading to unauthorized access points or service interruptions.
Think of it like a clever con artist convincing a person to change their bank account details over the phone, but only able to access their limited transaction settings and not their entire account. The attacker needs to trick the target into clicking a link to pull off this sneaky maneuver. This XSS vulnerability enables an unauthenticated attacker to inject malicious scripts into the web application, which execute in the context of an authenticated user's session, impacting device management features.
If an attacker successfully tricks an authenticated user into clicking their malicious link, they can manipulate device configuration parameters through the web-based management system. While they can't directly access sensitive system-level resources, they could still cause significant disruption by altering configurations, potentially leading to unauthorized access points or service interruptions. To guard against this vulnerability, ensure that all user inputs are sanitized and implement a robust Content Security Policy (CSP). Regularly update your systems to the latest version to mitigate risks associated with known vulnerabilities. Patching will be crucial once updates are available. You've got this! By following these steps, you'll be enhancing your security and tossing this vulnerability to the curb! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| phoenixcontact/fl_switch_2008f_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2016_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2105_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2108_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2116_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2204-2tc-2sfx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2205_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2206-2fx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2206-2fx_sm_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2206-2fx_sm_st_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2206-2fx_st_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2206-2sfx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2206-2sfx_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2206c-2fx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2207-fx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2207-fx_sm_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2208_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2208_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2208c_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2212-2tc-2sfx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2214-2fx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2214-2fx_sm_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2214-2sfx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2214-2sfx_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2216_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2216_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2303-8sp1 | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2304-2gc-2sfp_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2306-2sfp_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2306-2sfp_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2308_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2308_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2312-2gc-2sfp_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2314-2sfp_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2314-2sfp_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2316_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2316\/k1_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2316_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2404-2tc-2sfx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2406-2sfx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_nat_2008_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_nat_2208_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_nat_2304-2gc-2sfp_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2005_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2008_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2406-2sfx_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2408_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2408_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2412-2tc-2sfx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2414-2sfx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2414-2sfx_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2416_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2416_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2504-2gc-2sfp_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2506-2sfp_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2506-2sfp\/k1_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2506-2sfp_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2508_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2508\/k1_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2508_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2512-2gc-2sfp_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2514-2sfp_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2514-2sfp_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2516_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2516_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2608_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2608_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2708_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2708_pn_firmware | < 3.50 | 3.50 |