CVE-2026-22318: Stack-Based Buffer Overflow in File Transfer Parameter Handling

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-18 · updated 2026-06-17
Weakness: CWE-121

Description

A stack-based buffer overflow vulnerability in the device's file transfer parameter workflow allows a high-privileged attacker to send oversized POST parameters, causing memory corruption in an internal process, resulting in a DoS attack.

Affected products

Phoenix Contact FL NAT 2008: before 3.53 — fixed in 3.53
Phoenix Contact FL NAT 2208: before 3.53 — fixed in 3.53
Phoenix Contact FL NAT 2304-2GC-2SFP: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2005: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2008: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2008F: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2016: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2105: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2108: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2116: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2204-2TC-2SFX: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2205: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2206-2FX: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2206-2FX SM: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2206-2FX SM ST: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2206-2FX ST: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2206-2SFX: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2206-2SFX PN: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2206C-2FX: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2207-FX: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2207-FX SM: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2208: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2208 PN: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2208C: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2212-2TC-2SFX: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2214-2FX: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2214-2FX SM: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2214-2SFX: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2214-2SFX PN: before 3.53 — fixed in 3.53
Phoenix Contact FL SWITCH 2216: before 3.53 — fixed in 3.53

How to fix

Upgrade to a fixed version: Phoenix Contact FL NAT 2008 3.53; Phoenix Contact FL NAT 2208 3.53; Phoenix Contact FL NAT 2304-2GC-2SFP 3.53; Phoenix Contact FL SWITCH 2005 3.53; Phoenix Contact FL SWITCH 2008 3.53; Phoenix Contact FL SWITCH 2008F 3.53; Phoenix Contact FL SWITCH 2016 3.53; Phoenix Contact FL SWITCH 2105 3.53; Phoenix Contact FL SWITCH 2108 3.53; Phoenix Contact FL SWITCH 2116 3.53; Phoenix Contact FL SWITCH 2204-2TC-2SFX 3.53; Phoenix Contact FL SWITCH 2205 3.53. Check the vendor advisory for mitigations.

References

https://certvde.com/de/advisories/VDE-2025-104

Get alerted when CVE-2026-22318 or the next vulnerability affects your stack