wid-sec-w-2026-0765 · Published 2026-03-17 · View on BSI CERT-Bund ↗

Phoenix Contact FL SWITCH: Multiple Vulnerabilities

CVSS 7.2 HIGH

Risk Summary

A remote attacker with user privileges for the webUI can use the setting of the TFTP Filename with a POST Request to trigger a stack-based Buffer Overflow, resulting in a DoS attack.

CVEs (8)

CVE-2026-22317 CVE-2026-22316 CVE-2026-22318 CVE-2026-22319 CVE-2026-22320 CVE-2026-22321 CVE-2026-22322 CVE-2026-22323

Affected Vendors

Phoenix Contact

Affected Products (6)

Phoenix Contact · FL SWITCH 2xxx <3.53

Phoenix Contact · FL SWITCH 2xxx 3.53

Phoenix Contact · FL SWITCH TSN 23xx <3.53

Phoenix Contact · FL SWITCH TSN 23xx 3.53

Phoenix Contact · FL SWITCH 59xx <3.53

Phoenix Contact · FL SWITCH 59xx 3.53

Get alerted to advisories like this

OTWarden monitors CISA, BSI, Siemens, Rockwell and more — and emails you within 2 hours when your vendors are affected.

Start free trial Learn more