CISA + vendors
ICS Advisories
Advisories specifically aimed at industrial control systems — from CISA ICS-CERT and directly from vendors (including Siemens, ABB, Schneider Electric, WAGO and Phoenix Contact) — including revision history (initial publication, Update A, Update B) and linked CVEs.
1
Found
Advisory data: live connection— last retrieved: 7 November 2026 at 01:34.
Filters
1 active1 advisories found
VDE-2025-071
Phoenix Contact: Multiple Vulnerabilities in FL SWITCH 2xxx Firmware
Published
9 December 2025
Last update
12 January 2026
Linked CVEs
Affected sectors
Risk evaluation
Multiple vulnerabilities have been identified in the FL SWITCH 2xxx firmware prior to version 3.50. Two of these (CVE-2025-41692 and CVE-2025-41696) enable an attacker to access the device's file system. Two other vulnerabilities (CVE-2025-41693 and CVE-2025-41694) are related to Denial of Service (DoS) attacks, which partly limit the device's functionality. Another vulnerability (CVE-2025-41697) allows an unauthenticated physical attacker to access a login shell via an undocumented UART port. Furthermore, there are multiple vulnerabilities relating to reflected cross-site scripting in the web-based management of the device. All vulnerabilities have been resolved in firmware version 3.50.
Mitigation summary
Phoenix Contact strongly recommends to upgrade to firmware 3.50 which addresses this vulnerability and is available for download for all affected devices.
Revision history (2)
Initial publication — 9 December 2025
Initial release.
Update A — 12 January 2026
Version range specifier and product idfentification helper added to firmware branch of product tree.