High severity · published Feb 2, 2022
CVE-2022-22509
In Phoenix Contact FL SWITCH Series 2xxx in version 3.00 an incorrect privilege assignment allows an low privileged user to enable full access to the device configuration
8.8
CVSS
1%
EPSS
No
On KEV
Description
In Phoenix Contact FL SWITCH Series 2xxx in version 3.00 an incorrect privilege assignment allows an low privileged user to enable full access to the device configuration.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FS
FL Switch 2005 Firmware · Phoenixcontact
3.00 · source: NVD
FS
FL Switch 2008 Firmware · Phoenixcontact
3.00 · source: NVD
FS
FL Switch 2008f Firmware · Phoenixcontact
3.00 · source: NVD
FS
FL Switch 2016 Firmware · Phoenixcontact
3.00 · source: NVD
FS
FL Switch 2105 Firmware · Phoenixcontact
3.00 · source: NVD
FS
FL Switch 2108 Firmware · Phoenixcontact
3.00 · source: NVD
FS
FL Switch 2116 Firmware · Phoenixcontact
3.00 · source: NVD
FS
FL Switch 2204-2tc-2sfx Firmware · Phoenixcontact
3.00 · source: NVD
FS
FL Switch 2206-2fx Firmware · Phoenixcontact
3.00 · source: NVD
FS
FL Switch 2206-2fx SM Firmware · Phoenixcontact
3.00 · source: NVD
FS
FL Switch 2206-2fx SM ST Firmware · Phoenixcontact
3.00 · source: NVD
FS
FL Switch 2206-2fx ST Firmware · Phoenixcontact
3.00 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-22509
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-22509
Mitigation
https://cert.vde.com/en/advisories/VDE-2022-001/
More from FL Switch 2005 Firmware
7.1
CVE-2025-41695
Reflected XSS vulnerability in dyn_conn.php
7.1
CVE-2025-41745
Reflected XSS vulnerability in pxc_portCntr2.php
7.1
CVE-2025-41746
Reflected XSS vulnerability in pxc_portSecCfg.php
7.1
CVE-2025-41747
Reflected XSS vulnerability in pxc_vlanIntfCfg.php
7.1
CVE-2025-41748
Reflected XSS vulnerability in pxc_Dot1xCfg.php