CVE-2025-41747: Reflected XSS vulnerability in pxc_vlanIntfCfg.php
Phoenix Contact · FL SWITCH 2005
Vendor fix available · Affected: Phoenix Contact FL SWITCH 2005 · Exploitation: likely to be exploited (10% or more)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 95% of scored CVEs
DescriptionCVE.org
An XSS vulnerability in pxc_vlanIntfCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.
Affected products20
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- Phoenix Contact · FL SWITCH 2005from 0.0.0 before 3.50
- Phoenix Contact · FL SWITCH 2008from 0.0.0 before 3.50
- Phoenix Contact · FL SWITCH 2016from 0.0.0 before 3.50
- Phoenix Contact · FL SWITCH 2105from 0.0.0 before 3.50
- Phoenix Contact · FL SWITCH 2108from 0.0.0 before 3.50
- Phoenix Contact · FL SWITCH 2116from 0.0.0 before 3.50
- Phoenix Contact · FL SWITCH 2204-2TC-2SFXfrom 0.0.0 before 3.50
- Phoenix Contact · FL SWITCH 2205from 0.0.0 before 3.50
- Phoenix Contact · FL SWITCH 2206-2FXfrom 0.0.0 before 3.50
- Phoenix Contact · FL SWITCH 2206-2FX SMfrom 0.0.0 before 3.50
- Phoenix Contact · FL SWITCH 2206-2FX SM STfrom 0.0.0 before 3.50
- Phoenix Contact · FL SWITCH 2206-2FX STfrom 0.0.0 before 3.50
- Phoenix Contact · FL SWITCH 2206-2SFXfrom 0.0.0 before 3.50
- Phoenix Contact · FL SWITCH 2206-2SFX PNfrom 0.0.0 before 3.50
- Phoenix Contact · FL SWITCH 2206C-2FXfrom 0.0.0 before 3.50
- Phoenix Contact · FL SWITCH 2207-FXfrom 0.0.0 before 3.50
- Phoenix Contact · FL SWITCH 2207-FX SMfrom 0.0.0 before 3.50
- Phoenix Contact · FL SWITCH 2208from 0.0.0 before 3.50
- Phoenix Contact · FL SWITCH 2208 PNfrom 0.0.0 before 3.50
- Phoenix Contact · FL SWITCH 2208Cfrom 0.0.0 before 3.50
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Likely to be exploited (10% or more). EPSS gives it a 10% or higher chance of exploitation in the next 30 days.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Weakness
- Cross-site Scripting
- Vendor
- Phoenix Contact
- Published
- December 2025
CoverageNo articles yet
No CyberSIXT article names CVE-2025-41747 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.