The vulnerability is a stack-based buffer overflow in the CLI login routine triggered by an oversized or unexpected username supplied over Telnet or SSH. The overflow corrupts the stack and crashes the login thread, closing the session. Because the crash is confined to the thread handling that user, other active CLI connections remain functional, qualifying the flaw primarily as a low‑severity availability disruption.

Affected devices include Phoenix Contact FL series such as FL NAT 2008, FL NAT 2208, FL NAT 2304‑2GC‑2SFP, and a broad set of FL SWITCH models (e.g., FL SWITCH 2005, 2008, 2016, 2105, 2108, 2116, 2204‑2TC‑2SFX, 2205, 2206‑2FX, and higher‑end models up to FL SWITCH 5924‑4SFP+). The specific firmware versions affected are not disclosed, suggesting the flaw may persist across multiple releases of these products.

The CVSS base score is 5.3, indicating a medium overall risk. No EPSS value is available, and the flaw is not listed in the CISA KEV catalog. An attacker would exploit the vulnerability by sending an oversized username via an unauthenticated Telnet or SSH session. Though the crash affects only a single thread, repeated attacks could degrade overall CLI availability. The flaw is technically exploitable but would likely be detected if system activity is monitored.