medium6.5
CVE-2025-41694
A low privileged remote attacker can run the webshell with an empty command containing whitespace.
Impact
A low privileged remote attacker can run the webshell with an empty command containing whitespace. The server will then block until it receives more data, resulting in a DoS condition of the websserver.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Phoenixcontact | Fl Switch 2708 Pn Firmware | before 3.50 |
| Phoenixcontact | Fl Switch 2708 Firmware | before 3.50 |
| Phoenixcontact | Fl Switch 2608 Pn Firmware | before 3.50 |
| Phoenixcontact | Fl Switch 2608 Firmware | before 3.50 |
| Phoenixcontact | Fl Switch 2516 Pn Firmware | before 3.50 |
| Phoenixcontact | Fl Switch 2208c Firmware | before 3.50 |
| Phoenixcontact | Fl Switch 2208 Pn Firmware | before 3.50 |
| Phoenixcontact | Fl Switch 2208 Firmware | before 3.50 |
| Phoenixcontact | Fl Switch 2207-Fx Sm Firmware | before 3.50 |
| Phoenixcontact | Fl Switch 2207-Fx Firmware | before 3.50 |
| Phoenixcontact | Fl Switch 2206c-2fx Firmware | before 3.50 |
| Phoenixcontact | Fl Switch 2206-2sfx Pn Firmware | before 3.50 |