High · published December 9, 2025
⚡ A crafty trick could turn your users into unwitting accomplices! An XSS vulnerability in pxc_portCntr.php allows an attacker to lure authenticated users into clicking a malicious link, potentially changing critical device configuration. 😱 Think of this like a phishing email that masquerades as a friendly invitation to an event. While it won’t give the attacker the keys to your castle, it might let them rearrange the furniture inside, causing chaos for your operations. An attacker could manipulate the parameters available in the web-based management interface, leading to unauthorized changes that could disrupt device settings. This might not grant full access, but the mischief they can create could significantly affect how your system functions.
Think of this like a phishing email that masquerades as a friendly invitation to an event. While it won’t give the attacker the keys to your castle, it might let them rearrange the furniture inside, causing chaos for your operations. This XSS vulnerability allows an unauthenticated remote attacker to inject malicious scripts into a link, which, when clicked by an authenticated user, modifies device configuration parameters through the web interface. While session cookies are secured with the httpOnly flag, this attack relies on user interaction to be effective.
An attacker could manipulate the parameters available in the web-based management interface, leading to unauthorized changes that could disrupt device settings. This might not grant full access, but the mischief they can create could significantly affect how your system functions. To mitigate this risk, update to the latest version of your software where this issue is patched. Additionally, educate users about the dangers of clicking unsolicited links and implement Content Security Policies (CSP) to further protect against XSS attacks. This is fixable! Stay vigilant, implement these steps, and you'll have a stronger defense in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| phoenixcontact/fl_nat_2008_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_nat_2208_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_nat_2304-2gc-2sfp_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2005_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2008_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2008f_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2016_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2105_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2108_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2116_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2204-2tc-2sfx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2205_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2206-2fx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2206-2fx_sm_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2206-2fx_sm_st_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2206-2fx_st_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2206-2sfx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2206-2sfx_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2206c-2fx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2207-fx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2207-fx_sm_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2208_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2208_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2208c_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2212-2tc-2sfx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2214-2fx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2214-2fx_sm_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2214-2sfx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2214-2sfx_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2216_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2216_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2303-8sp1 | < 3.5.0 | 3.5.0 |
| phoenixcontact/fl_switch_2304-2gc-2sfp_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2306-2sfp_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2306-2sfp_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2308_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2308_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2312-2gc-2sfp_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2314-2sfp_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2314-2sfp_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2316\/k1_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2316_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2316_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2404-2tc-2sfx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2406-2sfx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2406-2sfx_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2408_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2408_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2412-2tc-2sfx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2414-2sfx_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2414-2sfx_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2416_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2416_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2504-2gc-2sfp_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2506-2sfp\/k1_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2506-2sfp_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2506-2sfp_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2508\/k1_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2508_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2508_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2512-2gc-2sfp_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2514-2sfp_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2514-2sfp_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2516_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2516_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2608_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2608_pn_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2708_firmware | < 3.50 | 3.50 |
| phoenixcontact/fl_switch_2708_pn_firmware | < 3.50 | 3.50 |