CVE-2025-41694
BaseFortify
Publication date: 2025-12-09
Last updated on: 2025-12-09
Assigner: CERT VDE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| phoenix_contact | fl_switch | 3.50 |
| phoenix_contact | fl_switch | 2xxx |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability allows a low privileged remote attacker to run the webshell with an empty command that contains only whitespace. When this happens, the server blocks and waits for more data, causing a denial of service (DoS) condition on the webserver.
How can this vulnerability impact me? :
The impact of this vulnerability is a denial of service (DoS) condition on the webserver, which means the server becomes unresponsive or unavailable to legitimate users.
What immediate steps should I take to mitigate this vulnerability?
The provided resources do not specify immediate mitigation steps for CVE-2025-41694. However, since the vulnerability involves a denial of service condition triggered by a remote attacker sending an empty command with whitespace to the webshell, general mitigation would include monitoring and restricting access to the webshell interface and applying any available firmware updates from the vendor. No specific commands or patches are mentioned in the resources.