CVE-2025-41694: Authenticated Denial-of-Service via Webshell

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-09 · updated 2026-10-07
Weakness: CWE-770

Description

A low privileged remote attacker can run the webshell with an empty command containing whitespace. The server will then block until it receives more data, resulting in a DoS condition of the websserver.

Affected products

Phoenixcontact Fl Nat 2008 Firmware: before 3.50 — fixed in 3.50
Phoenixcontact Fl Nat 2208 Firmware: before 3.50 — fixed in 3.50
Phoenixcontact Fl Nat 2304-2Gc-2Sfp Firmware: before 3.50 — fixed in 3.50
Phoenixcontact Fl Switch 2005 Firmware: before 3.50 — fixed in 3.50
Phoenixcontact Fl Switch 2008 Firmware: before 3.50 — fixed in 3.50
Phoenixcontact Fl Switch 2008F Firmware: before 3.50 — fixed in 3.50
Phoenixcontact Fl Switch 2016 Firmware: before 3.50 — fixed in 3.50
Phoenixcontact Fl Switch 2105 Firmware: before 3.50 — fixed in 3.50
Phoenixcontact Fl Switch 2108 Firmware: before 3.50 — fixed in 3.50
Phoenixcontact Fl Switch 2116 Firmware: before 3.50 — fixed in 3.50
Phoenixcontact Fl Switch 2204-2Tc-2Sfx Firmware: before 3.50 — fixed in 3.50
Phoenixcontact Fl Switch 2205 Firmware: before 3.50 — fixed in 3.50
Phoenixcontact Fl Switch 2206-2Fx Firmware: before 3.50 — fixed in 3.50
Phoenixcontact Fl Switch 2206-2Fx Sm Firmware: before 3.50 — fixed in 3.50
Phoenixcontact Fl Switch 2206-2Fx Sm St Firmware: before 3.50 — fixed in 3.50
Phoenixcontact Fl Switch 2206-2Fx St Firmware: before 3.50 — fixed in 3.50
Phoenixcontact Fl Switch 2206-2Sfx Firmware: before 3.50 — fixed in 3.50
Phoenixcontact Fl Switch 2206-2Sfx Pn Firmware: before 3.50 — fixed in 3.50
Phoenixcontact Fl Switch 2206C-2Fx Firmware: before 3.50 — fixed in 3.50
Phoenixcontact Fl Switch 2207-Fx Firmware: before 3.50 — fixed in 3.50
Phoenixcontact Fl Switch 2207-Fx Sm Firmware: before 3.50 — fixed in 3.50
Phoenixcontact Fl Switch 2208 Firmware: before 3.50 — fixed in 3.50
Phoenixcontact Fl Switch 2208 Pn Firmware: before 3.50 — fixed in 3.50
Phoenixcontact Fl Switch 2208C Firmware: before 3.50 — fixed in 3.50
Phoenixcontact Fl Switch 2212-2Tc-2Sfx Firmware: before 3.50 — fixed in 3.50
Phoenixcontact Fl Switch 2214-2Fx Firmware: before 3.50 — fixed in 3.50
Phoenixcontact Fl Switch 2214-2Fx Sm Firmware: before 3.50 — fixed in 3.50
Phoenixcontact Fl Switch 2214-2Sfx Firmware: before 3.50 — fixed in 3.50
Phoenixcontact Fl Switch 2214-2Sfx Pn Firmware: before 3.50 — fixed in 3.50
Phoenixcontact Fl Switch 2216 Firmware: before 3.50 — fixed in 3.50

How to fix

Upgrade to a fixed version: Phoenixcontact Fl Nat 2008 Firmware 3.50; Phoenixcontact Fl Nat 2208 Firmware 3.50; Phoenixcontact Fl Nat 2304-2Gc-2Sfp Firmware 3.50; Phoenixcontact Fl Switch 2005 Firmware 3.50; Phoenixcontact Fl Switch 2008 Firmware 3.50; Phoenixcontact Fl Switch 2008F Firmware 3.50; Phoenixcontact Fl Switch 2016 Firmware 3.50; Phoenixcontact Fl Switch 2105 Firmware 3.50; Phoenixcontact Fl Switch 2108 Firmware 3.50; Phoenixcontact Fl Switch 2116 Firmware 3.50; Phoenixcontact Fl Switch 2204-2Tc-2Sfx Firmware 3.50; Phoenixcontact Fl Switch 2205 Firmware 3.50. Check the vendor advisory for mitigations.

References

https://certvde.com/de/advisories/VDE-2025-071

Get alerted when CVE-2025-41694 or the next vulnerability affects your stack