Medium severity · published Mar 18, 2026
CVE-2026-22321
Stack-Based Buffer Overflow in CLI Login Username Handling over CLI
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
A stack-based buffer overflow in the device's Telnet/SSH CLI login routine occurs when a unauthenticated attacker send an oversized or unexpected username input. An overflow condition crashes the thread handling the login attempt, forcing the session to close. Because other CLI sessions remain unaffected, the impact is limited to a low‑severity availability disruption.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FS
FL SWITCH 2005 · Phoenix Contact
0.0.0 before 3.53 · source: vendor
FS
FL SWITCH 2008 · Phoenix Contact
0.0.0 before 3.53 · source: vendor
FS
FL SWITCH 2016 · Phoenix Contact
0.0.0 before 3.53 · source: vendor
FS
FL SWITCH 2105 · Phoenix Contact
0.0.0 before 3.53 · source: vendor
FS
FL SWITCH 2108 · Phoenix Contact
0.0.0 before 3.53 · source: vendor
FS
FL SWITCH 2116 · Phoenix Contact
0.0.0 before 3.53 · source: vendor
FS
FL SWITCH 2204-2TC-2SFX · Phoenix Contact
0.0.0 before 3.53 · source: vendor
FS
FL SWITCH 2205 · Phoenix Contact
0.0.0 before 3.53 · source: vendor
FS
FL SWITCH 2206-2FX · Phoenix Contact
0.0.0 before 3.53 · source: vendor
FS
FL SWITCH 2206-2FX SM · Phoenix Contact
0.0.0 before 3.53 · source: vendor
FS
FL SWITCH 2206-2FX SM ST · Phoenix Contact
0.0.0 before 3.53 · source: vendor
FS
FL SWITCH 2206-2FX ST · Phoenix Contact
0.0.0 before 3.53 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-22321
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-22321
certvde.com
https://certvde.com/de/advisories/VDE-2025-104
More from FL SWITCH 2005
7.2
CVE-2026-22317
Command Injection Vulnerability in Root CA Certificate Transfer Workflow
7.1
CVE-2026-22323
Cross‑Site Request Forgery in Link Aggregation Configuration
7.1
CVE-2026-22322
Stored Cross‑Site Scripting in Link Aggregation Name Handling
7.1
CVE-2025-41695
Reflected XSS vulnerability in dyn_conn.php
7.1
CVE-2025-41745
Reflected XSS vulnerability in pxc_portCntr2.php