Back to overview

Phoenix Contact: Multiple Vulnerabilities in FL SWITCH 2xxx, FL SWITCH TSN 23xx and FL SWITCH 59xx Firmware

VDE-2025-104
Last update
03/18/2026 09:00
Published at
03/18/2026 09:00
Vendor(s)
Phoenix Contact GmbH & Co. KG
External ID
VDE-2025-104
CSAF Document
Download

Summary

Multiple vulnerabilities have been identified in the FL SWITCH 2xxx, FL SWITCH TSN 23xx and FL SWITCH 59xx firmware prior to version 3.53. One of these (CVE-2026-22317) enables an attacker to execute system commands as root user on the device. Five other vulnerabilities (CVE-2026-22316, CVE-2026-22318, CVE-2026-22319, CVE-2026-22320 and CVE-2026-22321) are related to Denial of Service (DoS) attacks, which partly limit the device's functionality. Another vulnerability (CVE-2026-22322) relates to reflected cross-site scripting in the web-based management of the device. And one vulnerability (CVE-2026-22323) relates to Cross‑Site Request Forgery in the web-based management of the device. All vulnerabilities have been resolved in firmware version 3.53.

Impact

Availability, integrity, or confidentiality of the FL SWITCH 2xxx, FL SWITCH TSN 23xx and FL SWITCH 59xx can be compromised by attacks using these vulnerabilities.

Affected Product(s)

Model no. Product name Affected versions
2702881 FL NAT 2008 Firmware <3.53, Firmware 3.50
2702882 FL NAT 2208 Firmware <3.53, Firmware 3.50
2702981 FL NAT 2304-2GC-2SFP Firmware 3.50, Firmware <3.53
2702323 FL SWITCH 2005 Firmware 3.50, Firmware <3.53
2702324 FL SWITCH 2008 Firmware <3.53, Firmware 3.50
1106707 FL SWITCH 2008F Firmware 3.50, Firmware <3.53
2702903 FL SWITCH 2016 Firmware <3.53, Firmware 3.50
2702665 FL SWITCH 2105 Firmware <3.53, Firmware 3.50
2702666 FL SWITCH 2108 Firmware <3.53, Firmware 3.50
2702908 FL SWITCH 2116 Firmware <3.53, Firmware 3.50
2702334 FL SWITCH 2204-2TC-2SFX Firmware <3.53, Firmware 3.50
2702326 FL SWITCH 2205 Firmware <3.53, Firmware 3.50
2702330 FL SWITCH 2206-2FX Firmware <3.53, Firmware 3.50
2702331 FL SWITCH 2206-2FX SM Firmware <3.53, Firmware 3.50
2702333 FL SWITCH 2206-2FX SM ST Firmware 3.50, Firmware <3.53
2702332 FL SWITCH 2206-2FX ST Firmware <3.53, Firmware 3.50
2702969 FL SWITCH 2206-2SFX Firmware <3.53, Firmware 3.50
1044028 FL SWITCH 2206-2SFX PN Firmware 3.50, Firmware <3.53
1095628 FL SWITCH 2206C-2FX Firmware 3.50, Firmware <3.53
2702328 FL SWITCH 2207-FX Firmware 3.50, Firmware <3.53
2702329 FL SWITCH 2207-FX SM Firmware <3.53, Firmware 3.50
2702327 FL SWITCH 2208 Firmware <3.53, Firmware 3.50
1044024 FL SWITCH 2208 PN Firmware <3.53, Firmware 3.50
1095627 FL SWITCH 2208C Firmware <3.53, Firmware 3.50
2702907 FL SWITCH 2212-2TC-2SFX Firmware <3.53, Firmware 3.50
2702905 FL SWITCH 2214-2FX Firmware <3.53, Firmware 3.50
2702906 FL SWITCH 2214-2FX SM Firmware <3.53, Firmware 3.50
1006188 FL SWITCH 2214-2SFX Firmware 3.50, Firmware <3.53
1044030 FL SWITCH 2214-2SFX PN Firmware <3.53, Firmware 3.50
2702904 FL SWITCH 2216 Firmware 3.50, Firmware <3.53
1044029 FL SWITCH 2216 PN Firmware 3.50, Firmware <3.53
1278397 FL SWITCH 2303-8SP1 Firmware 3.50, Firmware <3.53
2702653 FL SWITCH 2304-2GC-2SFP Firmware <3.53, Firmware 3.50
2702970 FL SWITCH 2306-2SFP Firmware 3.50, Firmware <3.53
1009222 FL SWITCH 2306-2SFP PN Firmware <3.53, Firmware 3.50
2702652 FL SWITCH 2308 Firmware <3.53, Firmware 3.50
1009220 FL SWITCH 2308 PN Firmware <3.53, Firmware 3.50
2702910 FL SWITCH 2312-2GC-2SFP Firmware <3.53, Firmware 3.50
1006191 FL SWITCH 2314-2SFP Firmware <3.53, Firmware 3.50
1031683 FL SWITCH 2314-2SFP PN Firmware 3.50, Firmware <3.53
2702909 FL SWITCH 2316 Firmware <3.53, Firmware 3.50
1031673 FL SWITCH 2316 PN Firmware 3.50, Firmware <3.53
1184084 FL SWITCH 2316/K1 Firmware <3.53, Firmware 3.50
1088853 FL SWITCH 2404-2TC-2SFX Firmware <3.53, Firmware 3.50
1043414 FL SWITCH 2406-2SFX Firmware <3.53, Firmware 3.50
1089126 FL SWITCH 2406-2SFX PN Firmware 3.50, Firmware <3.53
1043412 FL SWITCH 2408 Firmware <3.53, Firmware 3.50
1089133 FL SWITCH 2408 PN Firmware <3.53, Firmware 3.50
1088875 FL SWITCH 2412-2TC-2SFX Firmware 3.50, Firmware <3.53
1043423 FL SWITCH 2414-2SFX Firmware <3.53, Firmware 3.50
1089139 FL SWITCH 2414-2SFX PN Firmware 3.50, Firmware <3.53
1043416 FL SWITCH 2416 Firmware 3.50, Firmware <3.53
1089150 FL SWITCH 2416 PN Firmware <3.53, Firmware 3.50
1088872 FL SWITCH 2504-2GC-2SFP Firmware <3.53, Firmware 3.50
1043491 FL SWITCH 2506-2SFP Firmware 3.50, Firmware <3.53
1089135 FL SWITCH 2506-2SFP PN Firmware <3.53, Firmware 3.50
1215329 FL SWITCH 2506-2SFP/K1 Firmware 3.50, Firmware <3.53
1043484 FL SWITCH 2508 Firmware <3.53, Firmware 3.50
1089134 FL SWITCH 2508 PN Firmware <3.53, Firmware 3.50
1215350 FL SWITCH 2508/K1 Firmware <3.53, Firmware 3.50
1088856 FL SWITCH 2512-2GC-2SFP Firmware 3.50, Firmware <3.53
1043499 FL SWITCH 2514-2SFP Firmware <3.53, Firmware 3.50
1089154 FL SWITCH 2514-2SFP PN Firmware 3.50, Firmware <3.53
1043496 FL SWITCH 2516 Firmware <3.53, Firmware 3.50
1089205 FL SWITCH 2516 PN Firmware <3.53, Firmware 3.50
1106500 FL SWITCH 2608 Firmware 3.50, Firmware <3.53
1106616 FL SWITCH 2608 PN Firmware <3.53, Firmware 3.50
1106615 FL SWITCH 2708 Firmware 3.50, Firmware <3.53
1106610 FL SWITCH 2708 PN Firmware 3.50, Firmware <3.53
1525942 FL SWITCH 5916-8GC-4SFP+ Firmware <3.53, Firmware 3.50
1525943 FL SWITCH 5916SFP-8GC-4SFP+ Firmware 3.50, Firmware <3.53
1525945 FL SWITCH 5924-4GC Firmware 3.50, Firmware <3.53
1525939 FL SWITCH 5924-4SFP+ Firmware <3.53, Firmware 3.50
1525944 FL SWITCH 5924SFP-4GC Firmware 3.50, Firmware <3.53
1232305 FL SWITCH TSN 2312-2GC-2SFP Firmware 3.50, Firmware <3.53
1232302 FL SWITCH TSN 2314-2SFP Firmware <3.53, Firmware 3.50
1232304 FL SWITCH TSN 2316 Firmware 3.50, Firmware <3.53

Vulnerabilities

Expand / Collapse all

Published
03/18/2026 08:40
Severity
7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness
Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
Summary

A command injection vulnerability in the device’s Root CA certificate transfer workflow allows a high-privileged attacker to send crafted HTTP POST requests that result in arbitrary command execution on the underlying Linux OS with root privileges.

References
cve.org | nvd.nist.gov

Published
03/18/2026 08:40
Severity
7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Weakness
Cross-Site Request Forgery (CSRF) (CWE-352)
Summary

A CSRF vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker to trick authenticated users into sending unauthorized POST requests to the device by luring them to a malicious webpage. This can silently alter the device’s configuration without the victim’s knowledge or consent. Availability impact was set to low because after a successful attack the device will automatically recover without external intervention.

References
cve.org | nvd.nist.gov

Published
03/18/2026 08:40
Severity
7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Weakness
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Summary

A stored cross‑site scripting (XSS) vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker to create a trunk entry containing malicious HTML/JavaScript code. When the affected page is viewed, the injected script executes in the context of the victim’s browser, enabling unauthorized actions such as interface manipulation. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.

References
cve.org | nvd.nist.gov

Published
03/18/2026 08:40
Severity
6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
Stack-based Buffer Overflow (CWE-121)
Summary

A stack-based buffer overflow in the CLI's TFTP file‑transfer command handling allows a low-privileged attacker with Telnet/SSH access to trigger memory corruption by supplying unexpected or oversized filename input. Exploitation results in the corruption of the internal buffer, causing the CLI and web dashboard to become unavailable and leading to a denial of service.

References
cve.org | nvd.nist.gov

Published
03/18/2026 08:40
Severity
6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
Stack-based Buffer Overflow (CWE-121)
Summary

A remote attacker with user privileges for the webUI can use the setting of the TFTP Filename with a POST Request to trigger a stack-based Buffer Overflow, resulting in a DoS attack.

References
cve.org | nvd.nist.gov

Published
03/18/2026 08:40
Severity
5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
Stack-based Buffer Overflow (CWE-121)
Summary

A stack-based buffer overflow in the device's Telnet/SSH CLI login routine occurs when a unauthenticated attacker send an oversized or unexpected username input. An overflow condition crashes the thread handling the login attempt, forcing the session to close. Because other CLI sessions remain unaffected, the impact is limited to a low‑severity availability disruption.

References
cve.org | nvd.nist.gov

Published
03/18/2026 08:40
Severity
4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weakness
Stack-based Buffer Overflow (CWE-121)
Summary

A stack-based buffer overflow in the device's file installation workflow allows a high-privileged attacker to send oversized POST parameters that overflow a fixed-size stack buffer within an internal process, resulting in a DoS attack.

References
cve.org | nvd.nist.gov

Published
03/18/2026 08:40
Severity
4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weakness
Stack-based Buffer Overflow (CWE-121)
Summary

A stack-based buffer overflow vulnerability in the device's file transfer parameter workflow allows a high-privileged attacker to send oversized POST parameters, causing memory corruption in an internal process, resulting in a DoS attack.

References
cve.org | nvd.nist.gov

Remediation

Phoenix Contact recommends to update to the latest 3.53 Firmware Release which fixes these vulnerabilities.

Acknowledgments

Phoenix Contact GmbH & Co. KG thanks the following parties for their efforts:

  • CERT@VDE for coordination. (see https://certvde.com )
  • Gabriele Quagliarella from Nozomi Networks for Reporting

Revision History

Version Date Summary
1.0.0 03/18/2026 09:00 Initial release.