Medium severity · published Dec 9, 2025
CVE-2025-41692
A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak password generation…
6.8
CVSS
0.3%
EPSS
No
On KEV
Description
A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak password generation algorithm.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FN
FL Nat 2008 Firmware · Phoenixcontact
before 3.50 · source: NVD
FN
FL Nat 2208 Firmware · Phoenixcontact
before 3.50 · source: NVD
FN
FL Nat 2304-2gc-2sfp Firmware · Phoenixcontact
before 3.50 · source: NVD
FS
FL Switch 2005 Firmware · Phoenixcontact
before 3.50 · source: NVD
FS
FL Switch 2008 Firmware · Phoenixcontact
before 3.50 · source: NVD
FS
FL Switch 2008f Firmware · Phoenixcontact
before 3.50 · source: NVD
FS
FL Switch 2016 Firmware · Phoenixcontact
before 3.50 · source: NVD
FS
FL Switch 2105 Firmware · Phoenixcontact
before 3.50 · source: NVD
FS
FL Switch 2108 Firmware · Phoenixcontact
before 3.50 · source: NVD
FS
FL Switch 2116 Firmware · Phoenixcontact
before 3.50 · source: NVD
FS
FL Switch 2204-2tc-2sfx Firmware · Phoenixcontact
before 3.50 · source: NVD
FS
FL Switch 2205 Firmware · Phoenixcontact
before 3.50 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-41692
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-41692
Third Party Advisory
https://certvde.com/de/advisories/VDE-2025-071
More from FL Nat 2008 Firmware
7.1
CVE-2025-41752
An XSS vulnerability in pxc_portSfp.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to…
7.1
CVE-2025-41751
An XSS vulnerability in pxc_portCntr.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to…
7.1
CVE-2025-41750
An XSS vulnerability in pxc_PortCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to…
7.1
CVE-2025-41749
An XSS vulnerability in port_util.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to…
7.1
CVE-2025-41748
An XSS vulnerability in pxc_Dot1xCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to…