CVE-2025-41695
BaseFortify
Publication date: 2025-12-09
Last updated on: 2025-12-09
Assigner: CERT VDE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| phoenix_contact | fl_switch | 3.50 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that users are cautious about clicking on untrusted links or submitting manipulated POST requests while authenticated to the device's web management interface. Since the vulnerability involves changing device configuration parameters via web-based management, restricting access to the management interface and educating users about phishing risks can help. Additionally, monitor for firmware updates from the vendor that address this issue and apply them promptly once available.
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Scripting (XSS) issue in the dyn_conn.php file. An unauthenticated remote attacker can exploit it by tricking an authenticated user into sending a manipulated POST request to the device's web-based management interface. This allows the attacker to change configuration parameters available through the web application, but does not grant access to system-level resources or privileged functions. The session cookie is protected by the httpOnly flag, preventing session hijacking.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to alter device configuration parameters via the web management interface by exploiting an authenticated user's session. While it does not allow access to operating system internals or privileged functions, it can lead to unauthorized changes in device settings, potentially affecting device behavior or security.