CVE-2026-22316

Buffer Overflow using TFTP Filename

State: Published
Severity: 6.5 Medium
Published: Mar 18, 2026
Updated: Mar 18, 2026
Reserved: Jan 7, 2026

Description

A remote attacker with user privileges for the webUI can use the setting of the TFTP Filename with a POST Request to trigger a stack-based Buffer Overflow, resulting in a DoS attack.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CERTVDE

Weaknesses

CWE-121 Stack-based Buffer Overflow

Affected Products

Product	Versions
FL SWITCH 2005Phoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2008Phoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2016Phoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2105Phoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2108Phoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2116Phoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2204-2TC-2SFXPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2205Phoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2206-2FXPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2206-2FX SMPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2206-2FX SM STPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2206-2FX STPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2206-2SFXPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2206-2SFX PNPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2206C-2FXPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2207-FXPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2207-FX SMPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2208Phoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2208 PNPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2208CPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2212-2TC-2SFXPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2214-2FXPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2214-2FX SMPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2214-2SFXPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2214-2SFX PNPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2216Phoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2216 PNPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2304-2GC-2SFPPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2306-2SFPPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2306-2SFP PNPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2308Phoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2308 PNPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2312-2GC-2SFPPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2314-2SFPPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2314-2SFP PNPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2316Phoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2316 PNPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2404-2TC-2SFXPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2406-2SFXPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2406-2SFX PNPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2408Phoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2408 PNPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2412-2TC-2SFXPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2414-2SFXPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2414-2SFX PNPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2416Phoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2416 PNPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2504-2GC-2SFPPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2506-2SFPPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2506-2SFP PNPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2508Phoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2508 PNPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2512-2GC-2SFPPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2514-2SFPPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2514-2SFP PNPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2516Phoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2516 PNPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2608Phoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2608 PNPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2708Phoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2708 PNPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2303-8SP1Phoenix Contact	0.0.0 to before 3.53Affected
FL NAT 2008Phoenix Contact	0.0.0 to before 3.53Affected
FL NAT 2208Phoenix Contact	0.0.0 to before 3.53Affected
FL NAT 2304-2GC-2SFPPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2008FPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2316/K1Phoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2506-2SFP/K1Phoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 2508/K1Phoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH TSN 2316Phoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH TSN 2312-2GC-2SFPPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH TSN 2314-2SFPPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 5924-4GCPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 5916-8GC-4SFP+Phoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 5924SFP-4GCPhoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 5924-4SFP+Phoenix Contact	0.0.0 to before 3.53Affected
FL SWITCH 5916SFP-8GC-4SFP+Phoenix Contact	0.0.0 to before 3.53Affected

References

https://certvde.com/de/advisories/VDE-2025-104

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.