CVE-2025-41697 Shell access to UART Console
Attackers can gain root access via an undocumented UART port on Phoenix Contact industrial switches, enabling full device control.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-41697?
CVE-2025-41697 is a medium-severity authentication bypass vulnerability in Phoenix Contact FL NAT 2008, published on 9 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An attacker can use an undocumented UART port on the PCB as a side-channel to get root access e.g. with the credentials obtained from CVE-2025-41692.
Weakness: CWE-1299
Which versions are affected by CVE-2025-41697?
It affects 69 products.
Products include Phoenixcontact Fl Nat 2008 Firmware, Phoenixcontact Fl Nat 2208 Firmware, Phoenixcontact Fl Nat 2304-2gc-2sfp Firmware, Phoenixcontact Fl Switch 2005 Firmware, Phoenixcontact Fl Switch 2008 Firmware, Phoenixcontact Fl Switch 2008f Firmware and 63 more.
How do I fix CVE-2025-41697?
No fix has been published for CVE-2025-41697 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-41697 being exploited?
There is no known exploitation of CVE-2025-41697 in the wild and no public exploit code.
Other vulnerabilities in Phoenix Contact FL NAT 2008
- CVE-2025-41695 Reflected XSS vulnerability in dyn_conn.php
- CVE-2025-41745 Reflected XSS vulnerability in pxc_portCntr2.php
- CVE-2025-41746 Reflected XSS vulnerability in pxc_portSecCfg.php
- CVE-2025-41747 Reflected XSS vulnerability in pxc_vlanIntfCfg.php
- CVE-2025-41748 Reflected XSS vulnerability in pxc_Dot1xCfg.php
Sources
Also known as GHSA-ccrq-w269-c7pj.