CVE-2025-41694

MediumCVSS 6.5/10Last modified Oct 7, 2026

Description

A low privileged remote attacker can run the webshell with an empty command containing whitespace. The server will then block until it receives more data, resulting in a DoS condition of the websserver.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

VendorProductVersions
Phoenix ContactFL SWITCH 2005>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2008>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2016>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2105>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2108>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2116>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2204-2TC-2SFX>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2205>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2206-2FX>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2206-2FX SM>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2206-2FX SM ST>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2206-2FX ST>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2206-2SFX>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2206-2SFX PN>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2206C-2FX>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2207-FX>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2207-FX SM>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2208>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2208 PN>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2208C>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2212-2TC-2SFX>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2214-2FX>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2214-2FX SM>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2214-2SFX>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2214-2SFX PN>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2216>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2216 PN>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2304-2GC-2SFP>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2306-2SFP>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2306-2SFP PN>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2308>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2308 PN>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2312-2GC-2SFP>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2314-2SFP>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2314-2SFP PN>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2316>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2316 PN>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2404-2TC-2SFX>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2406-2SFX>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2406-2SFX PN>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2408>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2408 PN>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2412-2TC-2SFX>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2414-2SFX>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2414-2SFX PN>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2416>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2416 PN>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2504-2GC-2SFP>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2506-2SFP>= 0.0.0, < 3.50
Phoenix ContactFL SWITCH 2506-2SFP PN>= 0.0.0, < 3.50

References

Timeline

Published
Dec 9, 2025
Last modified
Oct 7, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-416957.1An XSS vulnerability in dyn_conn.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated CVE-2025-416964.6An attacker can use an undocumented UART port on the PCB as a side-channel with the user hardcoded credentials obtained from CVE-2025-41692 CVE-2025-416976.8An attacker can use an undocumented UART port on the PCB as a side-channel to get root access e.g. with the credentials obtained from CVECVE-2025-416987.8A low privileged local attacker can interact with the affected service although user-interaction should not be allowed.CVE-2025-416998.8An low privileged remote attacker with an account for the Web-based management can change the system configuration to perform a command injeCVE-2025-41706.4The Xavin&#039;s Review Ratings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xrr' shortcode in all veCVE-2025-417007.8An unauthenticated attacker can trick a local user into executing arbitrary code by opening a deliberately manipulated CODESYS project file CVE-2025-417017.8An unauthenticated attacker can trick a local user into executing arbitrary commands by opening a deliberately manipulated project file withCVE-2025-417029.8The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generaCVE-2025-417037.5An unauthenticated remote attacker can cause a Denial of Service by turning off the output of the UPS via Modbus command.CVE-2025-417045.3An unauthanticated remote attacker can perform a DoS of the Modbus service by sending a specific function and sub-function code without affeCVE-2025-417056.8An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend.
CVE-2025-41694: Medium severity, CVSS 6.5 | Vulnix