Fl Switch 2016 Firmware
Vendor:
First CVE: Feb 2, 2022 · Active for 4 years
15
Total CVEs
More Total CVEs than 93% of tracked products
7.5
Avg CVEs / Year
Higher CVE frequency than 94% of tracked products
6.8
Avg CVSS
Higher Avg CVSS than 40% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Fl Switch 2016 Firmware over time
Volume of CVEsAvg CVSS Base Score
First CVE
Feb 2, 2022
4 years ago
Most Recent CVE
Dec 9, 2025
231 days ago
CVE Severity & Scoring
Fl Switch 2016 Firmware15 CVEs
33%
67%
All CVEs353,173 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local0 (0.0%)
Network13 (86.7%)
Unknown0 (0.0%)
Physical2 (13.3%)
Adjacent Network0 (0.0%)
Attack Complexity
Low15 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None6 (40.0%)
Unknown0 (0.0%)
Required9 (60.0%)
Privileges Required
Low3 (20.0%)
High1 (6.7%)
None11 (73.3%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (15 CVEs).
15 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-22509HIGH In Phoenix Contact FL SWITCH Series 2xxx in version 3.00 an incorrect privilege assignment allows an low privileged user to enable full access to the device configuration. | Feb 2, 2022 | 8.8 | 28 | NO | NO |
CVE-2025-41752HIGH An XSS vulnerability in pxc_portSfp.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to c | Dec 9, 2025 | 7.1 | 26 | NO | NO |
CVE-2025-41748HIGH An XSS vulnerability in pxc_Dot1xCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to | Dec 9, 2025 | 7.1 | 26 | NO | NO |
CVE-2025-41751HIGH An XSS vulnerability in pxc_portCntr.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to | Dec 9, 2025 | 7.1 | 25 | NO | NO |
CVE-2025-41750HIGH An XSS vulnerability in pxc_PortCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to c | Dec 9, 2025 | 7.1 | 25 | NO | NO |
CVE-2025-41747HIGH An XSS vulnerability in pxc_vlanIntfCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in ord | Dec 9, 2025 | 7.1 | 25 | NO | NO |
CVE-2025-41746HIGH An XSS vulnerability in pxc_portSecCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in orde | Dec 9, 2025 | 7.1 | 25 | NO | NO |
CVE-2025-41745HIGH An XSS vulnerability in pxc_portCntr2.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order | Dec 9, 2025 | 7.1 | 24 | NO | NO |
CVE-2025-41695HIGH An XSS vulnerability in dyn_conn.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to c | Dec 9, 2025 | 7.1 | 24 | NO | NO |
CVE-2025-41692MEDIUM A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak password generation algorit | Dec 9, 2025 | 6.8 | 24 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (15 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (15 CVEs).
Media Mentions
Signals from CVEs in this product scope (15 CVEs).
Top CNAs Publishing CVEs For Fl Switch 2016 Firmware
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 3.00 | 1 | 8.8 | 1.0% | 0 | 0 |