جزئیات آسیبپذیری
CVE-2025-41749
Phoenix Contact FL NATPhoenix Contact FL NAT 2208Phoenix Contact FL NAT 2304-2GC-2SFPPhoenix Contact FL SWITCHPhoenix Contact FL SWITCH 2008FPhoenix Contact FL SWITCH 2105
Reflected XSS vulnerability in port_util.php
CVSS 3.1
7.1بالا
شرح رسمی (انگلیسی)
An XSS vulnerability in port_util.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 7.1بالا | 3.1 | CVEProject cvelistV5 (CNA) (CERTVDE) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L |
محصولات آسیبپذیر
| فروشنده | محصول | نسخهها | منبع |
|---|---|---|---|
| Phoenix Contact | FL NAT 2008 | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL NAT 2208 | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL NAT 2304-2GC-2SFP | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2005 | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2008 | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2008F | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2016 | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2105 | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2108 | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2116 | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2204-2TC-2SFX | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2205 | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2206-2FX | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2206-2FX SM | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2206-2FX SM ST | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2206-2FX ST | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2206-2SFX | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2206-2SFX PN | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2206C-2FX | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2207-FX | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2207-FX SM | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2208 | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2208 PN | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2208C | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2212-2TC-2SFX | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2214-2FX | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2214-2FX SM | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2214-2SFX | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2214-2SFX PN | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2216 | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2216 PN | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2303-8SP1 | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2304-2GC-2SFP | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2306-2SFP | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2306-2SFP PN | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2308 | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2308 PN | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2312-2GC-2SFP | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2314-2SFP | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2314-2SFP PN | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2316 | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2316 PN | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2316/K1 | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2404-2TC-2SFX | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2406-2SFX | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2406-2SFX PN | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2408 | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2408 PN | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2412-2TC-2SFX | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2414-2SFX | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2414-2SFX PN | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2416 | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2416 PN | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2504-2GC-2SFP | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2506-2SFP | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2506-2SFP PN | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2506-2SFP/K1 | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2508 | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2508 PN | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2508/K1 | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2512-2GC-2SFP | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2514-2SFP | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2514-2SFP PN | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2516 | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2516 PN | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2608 | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2608 PN | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2708 | v < 3.50 | CVEProject cvelistV5 (CNA) |
| Phoenix Contact | FL SWITCH 2708 PN | v < 3.50 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۱
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیبپذیریهای تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۴/۰۹/۱۸
- آخرین بهروزرسانی
- ۱۴۰۴/۰۹/۱۸
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- CERTVDE
پیشبینی بهرهبرداری (EPSS)
۰٫۶۵٪
احتمال بهرهبرداری در ۳۰ روز
۵۱٫۵٪
صدک (نسبت به همهی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- خیر
- وضعیت بهرهبرداری
- ندارد
- اثر فنی
- جزئی
ضعفها (CWE)
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')