CVE-2025-41693
BaseFortify
Publication date: 2025-12-09
Last updated on: 2025-12-09
Assigner: CERT VDE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| phoenix_contact | fl_switch | 3.50 |
| phoenix_contact | fl_switch | 3.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, users should update the firmware of the affected devices to version 3.50 or later, as this version resolves related vulnerabilities. Since the vulnerability involves SSH command execution after login, limiting SSH access and monitoring for unusual SSH sessions may also help, but the primary mitigation is updating the firmware. [1]
Can you explain this vulnerability to me?
This vulnerability allows a low privileged remote attacker to use the SSH feature to execute commands directly after login. The process initiated by the attacker remains open and consumes system resources, which leads to reduced performance of the management functions. However, the switching functionality is not affected.
How can this vulnerability impact me? :
The vulnerability can impact you by causing reduced performance of management functions due to the attacker keeping processes open and consuming resources. This may degrade the system's ability to manage operations efficiently, although the switching functionality remains unaffected.