CVE-2025-41746— PHOENIX CONTACT FL SWITCH 跨站脚本漏洞
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2025-41746の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Reflected XSS vulnerability in pxc_portSecCfg.php
ソース: NVD (National Vulnerability Database)
脆弱性説明
An XSS vulnerability in pxc_portSecCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.
ソース: NVD (National Vulnerability Database)
CVSS情報
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
PHOENIX CONTACT FL SWITCH 跨站脚本漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
PHOENIX CONTACT FL SWITCH是德国菲尼克斯电气（PHOENIX CONTACT）公司的一款工业级以太网交换机。 PHOENIX CONTACT FL SWITCH 3.50之前版本存在跨站脚本漏洞，该漏洞源于跨站脚本攻击，可能导致设备配置参数被修改。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
II. CVE-2025-41746の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2025-41746のインテリジェンス情報
请登录查看更多情报信息。
Same Patch Batch · Phoenix Contact · 2025-12-09 · 14 CVEs total
| CVE-2025-41695 | 7.1 HIGH | Reflected XSS vulnerability in dyn_conn.php |
| CVE-2025-41749 | 7.1 HIGH | Reflected XSS vulnerability in port_util.php |
| CVE-2025-41751 | 7.1 HIGH | Reflected XSS vulnerability in pxc_portCntr.php |
| CVE-2025-41745 | 7.1 HIGH | Reflected XSS vulnerability in pxc_portCntr2.php |
| CVE-2025-41750 | 7.1 HIGH | Reflected XSS vulnerability in pxc_PortCfg.php |
| CVE-2025-41747 | 7.1 HIGH | Reflected XSS vulnerability in pxc_vlanIntfCfg.php |
| CVE-2025-41748 | 7.1 HIGH | Reflected XSS vulnerability in pxc_Dot1xCfg.php |
| CVE-2025-41752 | 7.1 HIGH | Reflected XSS vulnerability in pxc_portSfp.php |
| CVE-2025-41692 | 6.8 MEDIUM | Weak/Predictable root Password |
| CVE-2025-41697 | 6.8 MEDIUM | Shell access to UART Console |
| CVE-2025-41694 | 6.5 MEDIUM | Authenticated Denial-of-Service via Webshell |
| CVE-2025-41696 | 4.6 MEDIUM | Hardcoded User Password |
| CVE-2025-41693 | 4.3 MEDIUM | Authenticated Denial-of-Service via SSH |
IV. 関連脆弱性
同じ製品: FL SWITCH 2005
- CVE-2026-22323
Cross‑Site Request Forgery in Link Aggregation Configuration - CVE-2026-22322
Stored Cross‑Site Scripting in Link Aggregation Name Handlin - CVE-2026-22321
Stack-Based Buffer Overflow in CLI Login Username Handling o - CVE-2026-22320
Stack-Based Buffer Overflow in TFTP File-Transfer Command Ha - CVE-2026-22319
Stack-Based Buffer Overflow in File Install Parameter Handli
同じベンダー: Phoenix Contact
- CVE-2024-43384
Phoenix Contact: Improper removal of sensitive information i - CVE-2026-22323
Cross‑Site Request Forgery in Link Aggregation Configuration - CVE-2026-22322
Stored Cross‑Site Scripting in Link Aggregation Name Handlin - CVE-2026-22321
Stack-Based Buffer Overflow in CLI Login Username Handling o - CVE-2026-22320
Stack-Based Buffer Overflow in TFTP File-Transfer Command Ha
同じ弱点: CWE-79
- CVE-2026-8262
Devs Palace ERP Online chart-save cross site scripting - CVE-2026-8256
Devs Palace ERP Online mr-save cross site scripting - CVE-2026-8255
Devs Palace ERP Online add_new_customer cross site scripting - CVE-2026-8254
Devs Palace ERP Online sales_save cross site scripting - CVE-2026-8253
Devs Palace ERP Online purchase_save cross site scripting
V. CVE-2025-41746へのコメント
まだコメントはありません