Key detail from the advisory: "A stack-based buffer overflow vulnerability in the device's file transfer parameter workflow allows a high-privileged attacker to send oversized POST parameters, causing memory corruption in an internal process, resulting in a DoS attack." The flaw occurs when the device processes oversized HTTP POST parameters linked to file transfer. The resulting uncontrolled write to the stack corrupts memory, causing the internal process to crash. The practical consequence is that the device becomes unresponsive, interrupting any industrial control functions that depend on continuous availability of that unit.

The vulnerability affects a broad portfolio of Phoenix Contact devices, including the FL NAT 2008, FL NAT 2208, FL NAT 2304-2GC-2SFP, and numerous models in the FL SWITCH series (e.g., FL SWITCH 2005, 2008, 2008F, 2016, 2105, 2108, 2116, 2204-2TC-2SFX, 2205, 2206-2FX, 2206-2FX SM, 2206-2FX SM ST, 2206-2FX ST, 2206-2SFX, 2206-2SFX PN, 2206C-2FX, 2207-FX, 2207-FX SM, 2208, 2208 PN, 2208C, 2212-2TC-2SFX, 2214-2FX, 2214-2FX SM, 2214-2SFX, 2214-2SFX PN, 2216, 2216 PN, 2303-8SP1, 2304-2GC-2SFP, 2306-2SFP, 2306-2SFP PN, 2308, 2308 PN, 2312-2GC-2SFP, 2314-2SFP, 2314-2SFP PN, 2316, 2316 PN, 2316/K1, 2404-2TC-2SFX, 2406-2SFX, 2406-2SFX PN, 2408, 2408 PN, 2412-2TC-2SFX, 2414-2SFX, 2414-2SFX PN, 2416, 2416 PN, 2504-2GC-2SFP, 2506-2SFP, 2506-2SFP PN, 2506-2SFP/K1, 2508, 2508 PN, 2508/K1, 2512-2GC-2SFP, 2514-2SFP, 2514-2SFP PN, 2516, 2516 PN, 2608, 2608 PN, 2708, 2708 PN, 5916-8GC-4SFP+, 5916SFP-8GC-4SFP+, 5924-4GC, 5924-4SFP+, 5924SFP-4GC, TSN 2312-2GC-2SFP, TSN 2314-2SFP, TSN 2316. No specific firmware version numbers are provided in the advisory.

The CVSS score is 4.9, which is moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers require high-privileged access to the device’s HTTP-based file transfer interface to submit oversized POST requests. Successful exploitation results in a crash of the internal process, leading to a denial‑of‑service condition that disrupts continuous operation of the device. The environment is likely a constrained industrial network; however, if the device is reachable from untrusted networks, the risk increases.