CVE-2025-41692
Crypto Weakness in Phoenixcontact Fl Switch 2708 Pn Firmware ≤ 3.50
Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:NSummary
CVE-2025-41692 is a medium-severity Use of Password Hash With Insufficient Computational Effort (CWE-916) vulnerability in Phoenixcontact Fl Switch 2303-8Sp1. Its CVSS base score is 6.8 (Medium).
Operationally, ranked at the 18th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-7 (Unsuccessful Logon Attempts) and IA-5 (Authenticator Management) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-201892
Vulnerability Data
A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak password generation algorithm.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires organizations to manage authenticators (including passwords) using strong generation algorithms and secure distribution, eliminating the weak password generation flaw that enables the brute-force attack.
Enforces limits on consecutive invalid logon attempts against the root/user OS accounts, directly blocking the remote brute-force technique described in the CVE.
Enforces access decisions only after successful authentication, ensuring the weak OS passwords cannot be used to gain unauthorized system-level access even if guessed.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Proper password hashing is a direct instance of using cryptographic hashes to protect data-at-rest.
Secure development practices explicitly include selection and configuration of strong, computationally expensive password hashes.
Authentication policies may reference password handling but do not address storage or computational cost of hashes.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requires secure handling of authentication information, which includes choosing strong password hashing schemes.
Requires appropriate use of cryptography, which encompasses selecting strong hashing algorithms for passwords.
Secure coding practices include implementing password storage with adequate computational effort.
Mandates secure authentication mechanisms, directly addressing the need for computationally strong password hashes.