Shell access to UART Console

published 2025-12-09 11 mo ago modified 2026-10-07 33 d ago also EUVD-2025-201893

cvss: 6.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 14%
public exploits: 0; none known

An attacker can use an undocumented UART port on the PCB as a side-channel to get root access e.g. with the credentials obtained from CVE-2025-41692.

Patch / fix

fixed in 30

Phoenix Contact FL SWITCH 2005 3.50
Phoenix Contact FL SWITCH 2008 3.50
Phoenix Contact FL SWITCH 2016 3.50
Phoenix Contact FL SWITCH 2105 3.50
Phoenix Contact FL SWITCH 2108 3.50
Phoenix Contact FL SWITCH 2116 3.50
Phoenix Contact FL SWITCH 2204-2TC-2SFX 3.50
Phoenix Contact FL SWITCH 2205 3.50
Phoenix Contact FL SWITCH 2206-2FX 3.50
Phoenix Contact FL SWITCH 2206-2FX SM 3.50
Phoenix Contact FL SWITCH 2206-2FX SM ST 3.50
Phoenix Contact FL SWITCH 2206-2FX ST 3.50
Phoenix Contact FL SWITCH 2206-2SFX 3.50
Phoenix Contact FL SWITCH 2206-2SFX PN 3.50
Phoenix Contact FL SWITCH 2206C-2FX 3.50
Phoenix Contact FL SWITCH 2207-FX 3.50
Phoenix Contact FL SWITCH 2207-FX SM 3.50
Phoenix Contact FL SWITCH 2208 3.50
Phoenix Contact FL SWITCH 2208 PN 3.50
Phoenix Contact FL SWITCH 2208C 3.50
Phoenix Contact FL SWITCH 2212-2TC-2SFX 3.50
Phoenix Contact FL SWITCH 2214-2FX 3.50
Phoenix Contact FL SWITCH 2214-2FX SM 3.50
Phoenix Contact FL SWITCH 2214-2SFX 3.50
Phoenix Contact FL SWITCH 2214-2SFX PN 3.50
Phoenix Contact FL SWITCH 2216 3.50
Phoenix Contact FL SWITCH 2216 PN 3.50
Phoenix Contact FL SWITCH 2304-2GC-2SFP 3.50
Phoenix Contact FL SWITCH 2306-2SFP 3.50
Phoenix Contact FL SWITCH 2306-2SFP PN 3.50

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 11 mo ago (2025-12-09)

Exploit prediction

0.24% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.8	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Phoenix Contact FL SWITCH 2005
Phoenix Contact FL SWITCH 2008
Phoenix Contact FL SWITCH 2016
Phoenix Contact FL SWITCH 2105
Phoenix Contact FL SWITCH 2108
Phoenix Contact FL SWITCH 2116
Phoenix Contact FL SWITCH 2204-2TC-2SFX
Phoenix Contact FL SWITCH 2205
Phoenix Contact FL SWITCH 2206-2FX
Phoenix Contact FL SWITCH 2206-2FX SM
Phoenix Contact FL SWITCH 2206-2FX SM ST
Phoenix Contact FL SWITCH 2206-2FX ST
Phoenix Contact FL SWITCH 2206-2SFX
Phoenix Contact FL SWITCH 2206-2SFX PN
Phoenix Contact FL SWITCH 2206C-2FX
Phoenix Contact FL SWITCH 2207-FX
Phoenix Contact FL SWITCH 2207-FX SM
Phoenix Contact FL SWITCH 2208
Phoenix Contact FL SWITCH 2208 PN
Phoenix Contact FL SWITCH 2208C
Phoenix Contact FL SWITCH 2212-2TC-2SFX
Phoenix Contact FL SWITCH 2214-2FX
Phoenix Contact FL SWITCH 2214-2FX SM
Phoenix Contact FL SWITCH 2214-2SFX
Phoenix Contact FL SWITCH 2214-2SFX PN
Phoenix Contact FL SWITCH 2216
Phoenix Contact FL SWITCH 2216 PN
Phoenix Contact FL SWITCH 2304-2GC-2SFP
Phoenix Contact FL SWITCH 2306-2SFP
Phoenix Contact FL SWITCH 2306-2SFP PN
Phoenix Contact FL SWITCH 2308
Phoenix Contact FL SWITCH 2308 PN
Phoenix Contact FL SWITCH 2312-2GC-2SFP
Phoenix Contact FL SWITCH 2314-2SFP
Phoenix Contact FL SWITCH 2314-2SFP PN
Phoenix Contact FL SWITCH 2316
Phoenix Contact FL SWITCH 2316 PN
Phoenix Contact FL SWITCH 2404-2TC-2SFX
Phoenix Contact FL SWITCH 2406-2SFX
Phoenix Contact FL SWITCH 2406-2SFX PN
Phoenix Contact FL SWITCH 2408
Phoenix Contact FL SWITCH 2408 PN
Phoenix Contact FL SWITCH 2412-2TC-2SFX
Phoenix Contact FL SWITCH 2414-2SFX
Phoenix Contact FL SWITCH 2414-2SFX PN
Phoenix Contact FL SWITCH 2416
Phoenix Contact FL SWITCH 2416 PN
Phoenix Contact FL SWITCH 2504-2GC-2SFP
Phoenix Contact FL SWITCH 2506-2SFP
Phoenix Contact FL SWITCH 2506-2SFP PN

Classification

Weakness

CWE-1299 Missing Protection Mechanism for Alternate Hardware Interface

References

certvde.com /de/advisories/VDE-2025-071
third-party-advisory

Sources

CVE List CVE-2025-41697
NVD CVE-2025-41697

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary