PHOENIX CONTACT FL SWITCH

An attacker with network access to a vulnerable FL SWITCH device can execute arbitrary commands on the network switch, potentially disrupting communication between your control systems, SCADA equipment, and field devices. This could prevent operators from monitoring or controlling critical processes like water treatment, pump stations, or substation operations.

Water authorities and electric utilities operating Phoenix Contact FL SWITCH devices in any production network, particularly those in critical control system paths such as water treatment plant SCADA networks, wastewater pump station automation, or electric substation communication networks. Any facility using these managed switches for industrial networking is affected.

An attacker on the network sends a specially crafted request to the FL SWITCH device's management interface. The switch lacks proper authentication and input validation, allowing the attacker to execute arbitrary commands remotely without needing valid credentials or credentials. Once commands execute on the switch, the attacker can reconfigure network routing, block traffic, or pivot to connected control systems.