Volerion logoVolerion
Volerion logoVolerion

Phoenix Contact FL SWITCH 2xxx Reflected Cross-Site Scripting Vulnerability

Vulnerability

A reflected cross-site scripting vulnerability has been identified in the web-based management interface of Phoenix Contact FL SWITCH 2xxx devices, all firmware versions prior to 3.50. This vulnerability allows an unauthenticated remote attacker to deceive an authenticated user into clicking a malicious link, which could then be used to alter device configuration parameters accessible through the web application. While the session cookie is protected by the httpOnly flag, preventing session hijacking, the vulnerability still poses a risk by allowing unauthorized changes to device settings.

Impact

Exploitation of this vulnerability could lead to unauthorized modifications of device configuration parameters via the web-based management interface.

Remediation

Users are advised to update to the latest FL SWITCH 2xxx firmware version 3.50, which addresses this vulnerability.

Added: Dec 9, 2025, 7:43 PM
Updated: Dec 9, 2025, 7:43 PM

Vulnerability Rating

Custom Algorithm
spread
4.5
impact
1.7
exploitability
6.0
remediation
7.7
relevance
1.4
threat
0.0
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.