A high-severity command injection vulnerability in Phoenix Contact FL SWITCH 2000 series devices allows authenticated attackers to achieve full system compromise.

This vulnerability is a command injection flaw (CWE-77) triggered via the Root CA certificate transfer workflow. An attacker with high-level administrative privileges can send crafted HTTP POST requests to execute arbitrary commands on the underlying Linux operating system with root-level permissions.

The ability to execute arbitrary commands as root grants an attacker complete control over the affected industrial network switch. Successful exploitation could lead to unauthorized network traffic interception, disruption of critical infrastructure operations, or use of the device as a pivot point for lateral movement within the production environment. Given the CVSS score of 7.2, this represents a significant risk to operational integrity and security.

Immediate Action: Update the firmware of all affected Phoenix Contact FL SWITCH devices to version 3.53 or later as specified in the vendor advisory.

Proactive Monitoring: Review device access logs for suspicious HTTP POST requests directed toward certificate management endpoints or unauthorized configuration changes.

Compensating Controls: Restrict management access to the device to a dedicated, isolated management network and utilize network segmentation to limit the exposure of the administrative interface.

Public Exploit Available: No (Exploit available: false)

Organizations utilizing affected Phoenix Contact hardware must prioritize firmware updates to version 3.53 to eliminate this command injection vector. Due to the potential for full system control and the critical nature of these devices in industrial settings, testing and deployment of these updates should be scheduled within the next standard maintenance window to mitigate the risk of unauthorized administrative abuse.