title: Cross-site Scripting Vulnerability in Phoenix Contact FL SWITCH SMCS series products
description: In Phoenix Contact FL SWITCH SMCS series products in multiple versions an attacker may insert malicious code via LLDP frames into the web-based management which could then be executed by the client.
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: FL SWITCH
vendor: Phoenix Contact
versions:
lessThanOrEqual: 4.70, status: affected, version: SMCS 16TX (2700996), versionType: custom
lessThanOrEqual: 4.70, status: affected, version: SMCS 14TX/2FX (2700997), versionType: custom
lessThanOrEqual: 4.70, status: affected, version: SMCS 14TX/2FX-SM (2701466), versionType: custom
lessThanOrEqual: 4.70, status: affected, version: SMCS 8GT (2891123), versionType: custom
lessThanOrEqual: 4.70, status: affected, version: SMCS 6GT/2SFP (2891479), versionType: custom
lessThanOrEqual: 4.70, status: affected, version: SMCS 8TX-PN (2989103), versionType: custom
lessThanOrEqual: 4.70, status: affected, version: SMCS 4TX-PN (2989093), versionType: custom
lessThanOrEqual: 4.70, status: affected, version: SMCS 8TX (2989226), versionType: custom
lessThanOrEqual: 4.70, status: affected, version: SMCS 6TX/2SFP (2989323), versionType: custom
lessThanOrEqual: 4.70, status: affected, version: SMN 6TX/2POF-PN (2700290), versionType: custom
lessThanOrEqual: 4.70, status: affected, version: SMN 8TX-PN (2989501), versionType: custom
lessThanOrEqual: 4.70, status: affected, version: SMN 6TX/2FX (2989543), versionType: custom
lessThanOrEqual: 4.70, status: affected, version: SMN 6TX/2FX SM (2989556), versionType: custom
}
{
product: FL NAT
vendor: Phoenix Contact
versions:
lessThanOrEqual: 4.63, status: affected, version: SMN 8TX (2989365), versionType: custom
lessThanOrEqual: 4.63, status: affected, version: SMN 8TX-M (2702443), versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
version: 3.1
]
workarounds: Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to the Phoenix Contact application note:
Measures to protect network-capable devices with Ethernet connection https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf