A remote attacker who is able to authenticate to the device’s WebUI can submit an oversized TFTP filename in a POST request. According to the vendor description, this input is improperly validated and causes a stack-based buffer overflow (CWE‑121). The overflow can crash the WebUI service or reboot the device, resulting in a denial‑of‑service (DoS) that disrupts network operations on the affected equipment.

The vulnerability applies to an extensive list of Phoenix Contact FL devices, including FL NAT 2008, FL NAT 2208, FL NAT 2304‑2GC‑2SFP, and numerous FL SWITCH models such as FL SWITCH 2005, FL SWITCH 2008F, FL SWITCH 2016, FL SWITCH 2205, FL SWITCH 2408, FL SWITCH 2504‑2GC‑2SFP, and others enumerated in the known CNA vendors/products field. No specific firmware or hardware revision is indicated, so all current versions of these models are potentially vulnerable.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score is not provided, so the likelihood of exploitation is not quantified. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a user to be authenticated to the WebUI, limiting the attack surface to those with write privileges. Successful exploitation leads to a DoS, which could interrupt services on the affected network segment.