CVE-2018-13992
The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 allows for plaintext transmission (HTTP) of user credentials by default.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.11%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 allows for plaintext transmission (HTTP) of user credentials by default.
- CVSS 3.0
- 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.11% probability · 66th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-311
- Affected
- phoenixcontact/fl switch 3005 firmware · phoenixcontact/fl switch 3005t firmware · phoenixcontact/fl switch 3004t-fx firmware · phoenixcontact/fl switch 3004t-fx st firmware · phoenixcontact/fl switch 3008 firmware · phoenixcontact/fl switch 3008t firmware · phoenixcontact/fl switch 3006t-2fx firmware · phoenixcontact/fl switch 3006t-2fx st firmware · phoenixcontact/fl switch 3012e-2sfx firmware · phoenixcontact/fl switch 3016e firmware · phoenixcontact/fl switch 3016 firmware · phoenixcontact/fl switch 3016t firmware · phoenixcontact/fl switch 3006t-2fx sm firmware · phoenixcontact/fl switch 4008t-2sfp firmware · phoenixcontact/fl switch 4008t-2gt-4fx sm firmware · phoenixcontact/fl switch 4008t-2gt-3fx sm firmware · phoenixcontact/fl switch 4808e-16fx lc-4gc firmware · phoenixcontact/fl switch 4808e-16fx sm-4gc firmware · phoenixcontact/fl switch 4808e-16fx sm st-4gc firmware · phoenixcontact/fl switch 4808e-16fx st-4gc firmware · +9 more
- Source
- cve@mitre.org
EPSS 1.1% since 27 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- http://www.securityfocus.com/bid/106737Third Party Advisory, VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-19-024-02Third Party Advisory, US Government Resource
- http://www.securityfocus.com/bid/106737Third Party Advisory, VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-19-024-02Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.