CVE-2025-41692 Weak/Predictable root Password
An attacker with webUI admin access can brute-force weak OS root passwords due to predictable generation, leading to full system compromise.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-41692?
CVE-2025-41692 is a medium-severity vulnerability in Phoenix Contact FL NAT 2008, published on 9 Dec 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak password generation algorithm.
Weakness: CWE-916
Which versions are affected by CVE-2025-41692?
It affects 69 products.
Products include Phoenixcontact Fl Nat 2008 Firmware, Phoenixcontact Fl Nat 2208 Firmware, Phoenixcontact Fl Nat 2304-2gc-2sfp Firmware, Phoenixcontact Fl Switch 2005 Firmware, Phoenixcontact Fl Switch 2008 Firmware, Phoenixcontact Fl Switch 2008f Firmware and 63 more.
How do I fix CVE-2025-41692?
No fix has been published for CVE-2025-41692 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-41692 being exploited?
There is no known exploitation of CVE-2025-41692 in the wild and no public exploit code.
Other vulnerabilities in Phoenix Contact FL NAT 2008
- CVE-2025-41695 Reflected XSS vulnerability in dyn_conn.php
- CVE-2025-41745 Reflected XSS vulnerability in pxc_portCntr2.php
- CVE-2025-41746 Reflected XSS vulnerability in pxc_portSecCfg.php
- CVE-2025-41747 Reflected XSS vulnerability in pxc_vlanIntfCfg.php
- CVE-2025-41748 Reflected XSS vulnerability in pxc_Dot1xCfg.php
Sources
Also known as GHSA-5q5j-x9p3-cg4x.