CVE-2025-41697
Phoenixcontact Fl Switch 2708 Pn Firmware ≤ 3.50
Raw vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2025-41697 is a medium-severity Missing Protection Mechanism for Alternate Hardware Interface (CWE-1299) vulnerability in Phoenixcontact Fl Switch 2303-8Sp1. Its CVSS base score is 6.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Abuse Elevation Control Mechanism (T1548); ranked at the 14th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SC-7 (Boundary Protection) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-201893
Vulnerability Data
An attacker can use an undocumented UART port on the PCB as a side-channel to get root access e.g. with the credentials obtained from CVE-2025-41692.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V13.3.3V13.3.2
Mitigating Controls (NIST 800-53 r5) AI
AC-3 requires access enforcement on every logical path to protected assets, directly stopping bypass via unguarded alternate hardware interfaces.
SC-7 mandates control at all external and key internal interfaces, preventing access-control bypass through alternate hardware paths.
CM-7 disables or restricts unnecessary ports and interfaces, eliminating many alternate hardware paths before they can be exploited.
SC-3 isolates security functions so that alternate interfaces cannot reach protected assets without passing through the reference monitor.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
CWE-1299 can impair DE.CM-09 by letting adverse events on unguarded alternate interfaces evade monitoring that assumes primary paths, yet the weakness only affects one narrow slice of the broad monitoring outcome.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure system architecture and engineering principles require protection of all interfaces, directly addressing unguarded alternate hardware paths.
Security testing can discover alternate-path weaknesses but does not inherently prevent them.
Information access restriction mandates controls on every path to protected assets, mitigating bypass via shadow or external interfaces.
Network security controls can limit exposure of alternate hardware interfaces but do not address internal hardware-level bypasses.
Secure coding practices reduce software-level bypasses but do not cover hardware interface protections.