Phoenix Contact FL SWITCH Products Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the Link Aggregation configuration interface of certain Phoenix Contact FL SWITCH products. This vulnerability allows an unauthenticated remote attacker to inject malicious HTML or JavaScript into a trunk entry. When the affected page is accessed, the injected script executes in the context of the user's browser, potentially leading to unauthorized manipulation of the interface. The vulnerability is present in FL SWITCH 2xxx, FL SWITCH TSN 23xx, and FL SWITCH 59xx firmware versions prior to 3.53.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the victim's browser.

Remediation

Users are advised to update to the latest firmware version 3.53, which addresses this vulnerability.