CVE-2026-22323

HIGH

Cross‑Site Request Forgery in Link Aggregation Configuration

Title source: cna
STIX 2.1

Description

A CSRF vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker to trick authenticated users into sending unauthorized POST requests to the device by luring them to a malicious webpage. This can silently alter the device’s configuration without the victim’s knowledge or consent. Availability impact was set to low because after a successful attack the device will automatically recover without external intervention.

References (1)

Core 1

Scores

CVSS v3 7.1
EPSS 0.0018
EPSS Percentile 7.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-352
Status published
Products (50)
Phoenix Contact/FL NAT 2008 0.0.0 - 3.53
Phoenix Contact/FL NAT 2208 0.0.0 - 3.53
Phoenix Contact/FL NAT 2304-2GC-2SFP 0.0.0 - 3.53
Phoenix Contact/FL SWITCH 2005 0.0.0 - 3.53
Phoenix Contact/FL SWITCH 2008 0.0.0 - 3.53
Phoenix Contact/FL SWITCH 2008F 0.0.0 - 3.53
Phoenix Contact/FL SWITCH 2016 0.0.0 - 3.53
Phoenix Contact/FL SWITCH 2105 0.0.0 - 3.53
Phoenix Contact/FL SWITCH 2108 0.0.0 - 3.53
Phoenix Contact/FL SWITCH 2116 0.0.0 - 3.53
... and 40 more
Published Mar 18, 2026
Tracked Since Mar 18, 2026