CVE-2026-22316: Buffer Overflow using TFTP Filename

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-18 · updated 2026-06-17
Weakness: CWE-121

Description

A remote attacker with user privileges for the webUI can use the setting of the TFTP Filename with a POST Request to trigger a stack-based Buffer Overflow, resulting in a DoS attack.

Affected products

Phoenix Contact FL NAT 2008: before 3.53 — fixed in 3.53
Phoenix Contact FL NAT 2208: before 3.53 — fixed in 3.53
Phoenix Contact FL NAT 2304-2GC-2SFP: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2005: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2008: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2008F: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2016: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2105: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2108: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2116: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2204-2TC-2SFX: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2205: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2206-2FX: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2206-2FX SM: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2206-2FX SM ST: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2206-2FX ST: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2206-2SFX: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2206-2SFX PN: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2206C-2FX: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2207-FX: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2207-FX SM: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2208: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2208 PN: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2208C: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2212-2TC-2SFX: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2214-2FX: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2214-2FX SM: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2214-2SFX: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2214-2SFX PN: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2216: before 3.53 — fixed in 3.53

How to fix

Upgrade to a fixed version: Phoenix Contact FL NAT 2008 3.53; Phoenix Contact FL NAT 2208 3.53; Phoenix Contact FL NAT 2304-2GC-2SFP 3.53; Phoenix Contact FL SWITCH 2005 3.53; Phoenix Contact FL SWITCH 2008 3.53; Phoenix Contact FL SWITCH 2008F 3.53; Phoenix Contact FL SWITCH 2016 3.53; Phoenix Contact FL SWITCH 2105 3.53; Phoenix Contact FL SWITCH 2108 3.53; Phoenix Contact FL SWITCH 2116 3.53; Phoenix Contact FL SWITCH 2204-2TC-2SFX 3.53; Phoenix Contact FL SWITCH 2205 3.53. Check the vendor advisory for mitigations.

References

https://certvde.com/de/advisories/VDE-2025-104

Get alerted when CVE-2026-22316 or the next vulnerability affects your stack