CVE-2025-41752 Reflected XSS vulnerability in pxc_portSfp.php
Unauthenticated remote attackers can execute reflected XSS to modify device configuration parameters via web management interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-41752?
CVE-2025-41752 is a high-severity cross-site scripting vulnerability in Phoenix Contact FL NAT 2008, published on 9 Dec 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An XSS vulnerability in pxc_portSfp.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.
Weakness: CWE-79
Which versions are affected by CVE-2025-41752?
It affects 69 products.
Products include Phoenixcontact Fl Nat 2008 Firmware, Phoenixcontact Fl Nat 2208 Firmware, Phoenixcontact Fl Nat 2304-2gc-2sfp Firmware, Phoenixcontact Fl Switch 2005 Firmware, Phoenixcontact Fl Switch 2008 Firmware, Phoenixcontact Fl Switch 2008f Firmware and 63 more.
How do I fix CVE-2025-41752?
No fix has been published for CVE-2025-41752 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-41752 being exploited?
There is no known exploitation of CVE-2025-41752 in the wild and no public exploit code.
Other vulnerabilities in Phoenix Contact FL NAT 2008
- CVE-2025-41695 Reflected XSS vulnerability in dyn_conn.php
- CVE-2025-41745 Reflected XSS vulnerability in pxc_portCntr2.php
- CVE-2025-41746 Reflected XSS vulnerability in pxc_portSecCfg.php
- CVE-2025-41747 Reflected XSS vulnerability in pxc_vlanIntfCfg.php
- CVE-2025-41748 Reflected XSS vulnerability in pxc_Dot1xCfg.php
Sources
Also known as GHSA-5592-rmfh-c6gv.