CVE-2026-223177.2HighCWE-77

CVE-2026-22317: Command Injection Vulnerability in Root CA Certificate Transfer Workflow

Phoenix Contact · FL SWITCH 2005

Vendor fix available · Affected: Phoenix Contact FL SWITCH 2005 · Exploitation: possible (1 to 10%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

1.1%probability of exploitation in the next 30 days

65th percentile

050100

Higher than 65% of scored CVEs

7.2HighCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

A command injection vulnerability in the device’s Root CA certificate transfer workflow allows a high-privileged attacker to send crafted HTTP POST requests that result in arbitrary command execution on the underlying Linux OS with root privileges.

Affected products20

From the CVE record. A product or version that is not listed is unknown, not unaffected.

Phoenix Contact · FL SWITCH 2005from 0.0.0 before 3.53
Phoenix Contact · FL SWITCH 2008from 0.0.0 before 3.53
Phoenix Contact · FL SWITCH 2016from 0.0.0 before 3.53
Phoenix Contact · FL SWITCH 2105from 0.0.0 before 3.53
Phoenix Contact · FL SWITCH 2108from 0.0.0 before 3.53
Phoenix Contact · FL SWITCH 2116from 0.0.0 before 3.53
Phoenix Contact · FL SWITCH 2204-2TC-2SFXfrom 0.0.0 before 3.53
Phoenix Contact · FL SWITCH 2205from 0.0.0 before 3.53
Phoenix Contact · FL SWITCH 2206-2FXfrom 0.0.0 before 3.53
Phoenix Contact · FL SWITCH 2206-2FX SMfrom 0.0.0 before 3.53
Phoenix Contact · FL SWITCH 2206-2FX SM STfrom 0.0.0 before 3.53
Phoenix Contact · FL SWITCH 2206-2FX STfrom 0.0.0 before 3.53
Phoenix Contact · FL SWITCH 2206-2SFXfrom 0.0.0 before 3.53
Phoenix Contact · FL SWITCH 2206-2SFX PNfrom 0.0.0 before 3.53
Phoenix Contact · FL SWITCH 2206C-2FXfrom 0.0.0 before 3.53
Phoenix Contact · FL SWITCH 2207-FXfrom 0.0.0 before 3.53
Phoenix Contact · FL SWITCH 2207-FX SMfrom 0.0.0 before 3.53
Phoenix Contact · FL SWITCH 2208from 0.0.0 before 3.53
Phoenix Contact · FL SWITCH 2208 PNfrom 0.0.0 before 3.53
Phoenix Contact · FL SWITCH 2208Cfrom 0.0.0 before 3.53

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Possible (1 to 10%). EPSS between 1% and 10%.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Command Injection · Command and Code Injection
Vendor: Phoenix Contact
Published: March 2026
Band: Possible (1 to 10%), March 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-22317 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.