Search criteria
6 vulnerabilities found for fl_switch_smn_8tx-pn_firmware by phoenixcontact
CVE-2021-21005 (GCVE-0-2021-21005)
Vulnerability from nvd – Published: 2021-06-25 18:25 – Updated: 2024-09-17 02:17
VLAI?
Title
Race Condition Vulnerability in Phoenix Contact FL SWITCH SMCS series products
Summary
In Phoenix Contact FL SWITCH SMCS series products in multiple versions if an attacker sends a hand-crafted TCP-Packet with the Urgent-Flag set and the Urgent-Pointer set to 0, the network stack will crash. The device needs to be rebooted afterwards.
Severity ?
7.5 (High)
CWE
- CWE-362 - Race Condition (Concurrent Execution using Shared Resource with Improper Synchronization)
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Phoenix Contact | FL SWITCH |
Affected:
SMCS 16TX (2700996) , ≤ 4.70
(custom)
Affected: SMCS 14TX/2FX (2700997) , ≤ 4.70 (custom) Affected: SMCS 14TX/2FX-SM (2701466) , ≤ 4.70 (custom) Affected: SMCS 8GT (2891123) , ≤ 4.70 (custom) Affected: SMCS 6GT/2SFP (2891479) , ≤ 4.70 (custom) Affected: SMCS 8TX-PN (2989103) , ≤ 4.70 (custom) Affected: SMCS 4TX-PN (2989093) , ≤ 4.70 (custom) Affected: SMCS 8TX (2989226) , ≤ 4.70 (custom) Affected: SMCS 6TX/2SFP (2989323) , ≤ 4.70 (custom) Affected: SMN 6TX/2POF-PN (2700290) , ≤ 4.70 (custom) Affected: SMN 8TX-PN (2989501) , ≤ 4.70 (custom) Affected: SMN 6TX/2FX (2989543) , ≤ 4.70 (custom) Affected: SMN 6TX/2FX SM (2989556) , ≤ 4.70 (custom) |
|||||||
|
|||||||||
Credits
This vulnerability has been discovered and reported by Anne Borcherding, Fraunhofer- Institut für Optronik, Systemtechnik und Bildauswertung IOSB. PHOENIX CONTACT thanks CERT@VDE for the coordination and support with this publication.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T17:53:23.060Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2021-023"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "FL SWITCH",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 16TX (2700996)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 14TX/2FX (2700997)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 14TX/2FX-SM (2701466)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 8GT (2891123)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 6GT/2SFP (2891479)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 8TX-PN (2989103)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 4TX-PN (2989093)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 8TX (2989226)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 6TX/2SFP (2989323)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMN 6TX/2POF-PN (2700290)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMN 8TX-PN (2989501)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMN 6TX/2FX (2989543)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMN 6TX/2FX SM (2989556)",
"versionType": "custom"
}
]
},
{
"product": "FL NAT",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThanOrEqual": "4.63",
"status": "affected",
"version": "SMN 8TX (2989365)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.63",
"status": "affected",
"version": "SMN 8TX-M (2702443)",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This vulnerability has been discovered and reported by Anne Borcherding, Fraunhofer- Institut f\u00fcr Optronik, Systemtechnik und Bildauswertung IOSB. PHOENIX CONTACT thanks CERT@VDE for the coordination and support with this publication."
}
],
"datePublic": "2021-06-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "In Phoenix Contact FL SWITCH SMCS series products in multiple versions if an attacker sends a hand-crafted TCP-Packet with the Urgent-Flag set and the Urgent-Pointer set to 0, the network stack will crash. The device needs to be rebooted afterwards."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Race Condition (Concurrent Execution using Shared Resource with Improper Synchronization)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-25T18:25:53",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2021-023"
}
],
"source": {
"advisory": "VDE-2021-023",
"defect": [
"VDE-2021-023"
],
"discovery": "EXTERNAL"
},
"title": "Race Condition Vulnerability in Phoenix Contact FL SWITCH SMCS series products",
"workarounds": [
{
"lang": "en",
"value": "Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to the Phoenix Contact application note:\nMeasures to protect network-capable devices with Ethernet connection https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf"
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "info@cert.vde.com",
"DATE_PUBLIC": "2021-06-23T10:00:00.000Z",
"ID": "CVE-2021-21005",
"STATE": "PUBLIC",
"TITLE": "Race Condition Vulnerability in Phoenix Contact FL SWITCH SMCS series products"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "FL SWITCH",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "SMCS 16TX (2700996)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 14TX/2FX (2700997)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 14TX/2FX-SM (2701466)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 8GT (2891123)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 6GT/2SFP (2891479)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 8TX-PN (2989103)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 4TX-PN (2989093)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 8TX (2989226)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 6TX/2SFP (2989323)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMN 6TX/2POF-PN (2700290)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMN 8TX-PN (2989501)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMN 6TX/2FX (2989543)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMN 6TX/2FX SM (2989556)",
"version_value": "4.70"
}
]
}
},
{
"product_name": "FL NAT",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "SMN 8TX (2989365)",
"version_value": "4.63"
},
{
"version_affected": "\u003c=",
"version_name": "SMN 8TX-M (2702443)",
"version_value": "4.63"
}
]
}
}
]
},
"vendor_name": "Phoenix Contact"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This vulnerability has been discovered and reported by Anne Borcherding, Fraunhofer- Institut f\u00fcr Optronik, Systemtechnik und Bildauswertung IOSB. PHOENIX CONTACT thanks CERT@VDE for the coordination and support with this publication."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In Phoenix Contact FL SWITCH SMCS series products in multiple versions if an attacker sends a hand-crafted TCP-Packet with the Urgent-Flag set and the Urgent-Pointer set to 0, the network stack will crash. The device needs to be rebooted afterwards."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-362 Race Condition (Concurrent Execution using Shared Resource with Improper Synchronization)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert.vde.com/en-us/advisories/vde-2021-023",
"refsource": "CONFIRM",
"url": "https://cert.vde.com/en-us/advisories/vde-2021-023"
}
]
},
"source": {
"advisory": "VDE-2021-023",
"defect": [
"VDE-2021-023"
],
"discovery": "EXTERNAL"
},
"work_around": [
{
"lang": "en",
"value": "Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to the Phoenix Contact application note:\nMeasures to protect network-capable devices with Ethernet connection https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf"
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2021-21005",
"datePublished": "2021-06-25T18:25:53.099513Z",
"dateReserved": "2020-12-17T00:00:00",
"dateUpdated": "2024-09-17T02:17:13.899Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-21004 (GCVE-0-2021-21004)
Vulnerability from nvd – Published: 2021-06-25 18:25 – Updated: 2024-09-16 22:08
VLAI?
Title
Cross-site Scripting Vulnerability in Phoenix Contact FL SWITCH SMCS series products
Summary
In Phoenix Contact FL SWITCH SMCS series products in multiple versions an attacker may insert malicious code via LLDP frames into the web-based management which could then be executed by the client.
Severity ?
7.4 (High)
CWE
- CWE-79 - Cross-site Scripting (XSS)
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Phoenix Contact | FL SWITCH |
Affected:
SMCS 16TX (2700996) , ≤ 4.70
(custom)
Affected: SMCS 14TX/2FX (2700997) , ≤ 4.70 (custom) Affected: SMCS 14TX/2FX-SM (2701466) , ≤ 4.70 (custom) Affected: SMCS 8GT (2891123) , ≤ 4.70 (custom) Affected: SMCS 6GT/2SFP (2891479) , ≤ 4.70 (custom) Affected: SMCS 8TX-PN (2989103) , ≤ 4.70 (custom) Affected: SMCS 4TX-PN (2989093) , ≤ 4.70 (custom) Affected: SMCS 8TX (2989226) , ≤ 4.70 (custom) Affected: SMCS 6TX/2SFP (2989323) , ≤ 4.70 (custom) Affected: SMN 6TX/2POF-PN (2700290) , ≤ 4.70 (custom) Affected: SMN 8TX-PN (2989501) , ≤ 4.70 (custom) Affected: SMN 6TX/2FX (2989543) , ≤ 4.70 (custom) Affected: SMN 6TX/2FX SM (2989556) , ≤ 4.70 (custom) |
|||||||
|
|||||||||
Credits
This vulnerability has been discovered and reported by Anne Borcherding, Fraunhofer- Institut für Optronik, Systemtechnik und Bildauswertung IOSB. PHOENIX CONTACT thanks CERT@VDE for the coordination and support with this publication.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T17:53:23.134Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2021-023"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "FL SWITCH",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 16TX (2700996)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 14TX/2FX (2700997)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 14TX/2FX-SM (2701466)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 8GT (2891123)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 6GT/2SFP (2891479)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 8TX-PN (2989103)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 4TX-PN (2989093)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 8TX (2989226)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 6TX/2SFP (2989323)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMN 6TX/2POF-PN (2700290)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMN 8TX-PN (2989501)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMN 6TX/2FX (2989543)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMN 6TX/2FX SM (2989556)",
"versionType": "custom"
}
]
},
{
"product": "FL NAT",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThanOrEqual": "4.63",
"status": "affected",
"version": "SMN 8TX (2989365)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.63",
"status": "affected",
"version": "SMN 8TX-M (2702443)",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This vulnerability has been discovered and reported by Anne Borcherding, Fraunhofer- Institut f\u00fcr Optronik, Systemtechnik und Bildauswertung IOSB. PHOENIX CONTACT thanks CERT@VDE for the coordination and support with this publication."
}
],
"datePublic": "2021-06-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "In Phoenix Contact FL SWITCH SMCS series products in multiple versions an attacker may insert malicious code via LLDP frames into the web-based management which could then be executed by the client."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-25T18:25:52",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2021-023"
}
],
"source": {
"advisory": "VDE-2021-023",
"defect": [
"VDE-2021-023"
],
"discovery": "EXTERNAL"
},
"title": "Cross-site Scripting Vulnerability in Phoenix Contact FL SWITCH SMCS series products",
"workarounds": [
{
"lang": "en",
"value": "Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to the Phoenix Contact application note:\nMeasures to protect network-capable devices with Ethernet connection https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf"
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "info@cert.vde.com",
"DATE_PUBLIC": "2021-06-23T10:00:00.000Z",
"ID": "CVE-2021-21004",
"STATE": "PUBLIC",
"TITLE": "Cross-site Scripting Vulnerability in Phoenix Contact FL SWITCH SMCS series products"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "FL SWITCH",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "SMCS 16TX (2700996)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 14TX/2FX (2700997)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 14TX/2FX-SM (2701466)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 8GT (2891123)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 6GT/2SFP (2891479)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 8TX-PN (2989103)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 4TX-PN (2989093)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 8TX (2989226)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 6TX/2SFP (2989323)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMN 6TX/2POF-PN (2700290)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMN 8TX-PN (2989501)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMN 6TX/2FX (2989543)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMN 6TX/2FX SM (2989556)",
"version_value": "4.70"
}
]
}
},
{
"product_name": "FL NAT",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "SMN 8TX (2989365)",
"version_value": "4.63"
},
{
"version_affected": "\u003c=",
"version_name": "SMN 8TX-M (2702443)",
"version_value": "4.63"
}
]
}
}
]
},
"vendor_name": "Phoenix Contact"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This vulnerability has been discovered and reported by Anne Borcherding, Fraunhofer- Institut f\u00fcr Optronik, Systemtechnik und Bildauswertung IOSB. PHOENIX CONTACT thanks CERT@VDE for the coordination and support with this publication."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In Phoenix Contact FL SWITCH SMCS series products in multiple versions an attacker may insert malicious code via LLDP frames into the web-based management which could then be executed by the client."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Cross-site Scripting (XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert.vde.com/en-us/advisories/vde-2021-023",
"refsource": "CONFIRM",
"url": "https://cert.vde.com/en-us/advisories/vde-2021-023"
}
]
},
"source": {
"advisory": "VDE-2021-023",
"defect": [
"VDE-2021-023"
],
"discovery": "EXTERNAL"
},
"work_around": [
{
"lang": "en",
"value": "Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to the Phoenix Contact application note:\nMeasures to protect network-capable devices with Ethernet connection https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf"
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2021-21004",
"datePublished": "2021-06-25T18:25:52.190088Z",
"dateReserved": "2020-12-17T00:00:00",
"dateUpdated": "2024-09-16T22:08:28.813Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-21003 (GCVE-0-2021-21003)
Vulnerability from nvd – Published: 2021-06-25 18:25 – Updated: 2024-09-17 01:31
VLAI?
Title
Denial of Service Vulnerability in Phoenix Contact FL SWITCH SMCS series products
Summary
In Phoenix Contact FL SWITCH SMCS series products in multiple versions fragmented TCP-Packets may cause a Denial of Service of Web-, SNMP- and ICMP-Echo services. The switching functionality of the device is not affected.
Severity ?
5.3 (Medium)
CWE
- CWE-404 - Improper Resource Shutdown or Release
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Phoenix Contact | FL SWITCH |
Affected:
SMCS 16TX (2700996) , ≤ 4.70
(custom)
Affected: SMCS 14TX/2FX (2700997) , ≤ 4.70 (custom) Affected: SMCS 14TX/2FX-SM (2701466) , ≤ 4.70 (custom) Affected: SMCS 8GT (2891123) , ≤ 4.70 (custom) Affected: SMCS 6GT/2SFP (2891479) , ≤ 4.70 (custom) Affected: SMCS 8TX-PN (2989103) , ≤ 4.70 (custom) Affected: SMCS 4TX-PN (2989093) , ≤ 4.70 (custom) Affected: SMCS 8TX (2989226) , ≤ 4.70 (custom) Affected: SMCS 6TX/2SFP (2989323) , ≤ 4.70 (custom) Affected: SMN 6TX/2POF-PN (2700290) , ≤ 4.70 (custom) Affected: SMN 8TX-PN (2989501) , ≤ 4.70 (custom) Affected: SMN 6TX/2FX (2989543) , ≤ 4.70 (custom) Affected: SMN 6TX/2FX SM (2989556) , ≤ 4.70 (custom) |
|||||||
|
|||||||||
Credits
This vulnerability has been discovered and reported by Anne Borcherding, Fraunhofer- Institut für Optronik, Systemtechnik und Bildauswertung IOSB. PHOENIX CONTACT thanks CERT@VDE for the coordination and support with this publication.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T17:53:23.063Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2021-023"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "FL SWITCH",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 16TX (2700996)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 14TX/2FX (2700997)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 14TX/2FX-SM (2701466)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 8GT (2891123)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 6GT/2SFP (2891479)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 8TX-PN (2989103)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 4TX-PN (2989093)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 8TX (2989226)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 6TX/2SFP (2989323)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMN 6TX/2POF-PN (2700290)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMN 8TX-PN (2989501)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMN 6TX/2FX (2989543)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMN 6TX/2FX SM (2989556)",
"versionType": "custom"
}
]
},
{
"product": "FL NAT",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThanOrEqual": "4.63",
"status": "affected",
"version": "SMN 8TX (2989365)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.63",
"status": "affected",
"version": "SMN 8TX-M (2702443)",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This vulnerability has been discovered and reported by Anne Borcherding, Fraunhofer- Institut f\u00fcr Optronik, Systemtechnik und Bildauswertung IOSB. PHOENIX CONTACT thanks CERT@VDE for the coordination and support with this publication."
}
],
"datePublic": "2021-06-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "In Phoenix Contact FL SWITCH SMCS series products in multiple versions fragmented TCP-Packets may cause a Denial of Service of Web-, SNMP- and ICMP-Echo services. The switching functionality of the device is not affected."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "CWE-404 Improper Resource Shutdown or Release",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-25T18:25:51",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2021-023"
}
],
"source": {
"advisory": "VDE-2021-023",
"defect": [
"VDE-2021-023"
],
"discovery": "EXTERNAL"
},
"title": "Denial of Service Vulnerability in Phoenix Contact FL SWITCH SMCS series products",
"workarounds": [
{
"lang": "en",
"value": "Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to the Phoenix Contact application note:\nMeasures to protect network-capable devices with Ethernet connection https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf"
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "info@cert.vde.com",
"DATE_PUBLIC": "2021-06-23T10:00:00.000Z",
"ID": "CVE-2021-21003",
"STATE": "PUBLIC",
"TITLE": "Denial of Service Vulnerability in Phoenix Contact FL SWITCH SMCS series products"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "FL SWITCH",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "SMCS 16TX (2700996)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 14TX/2FX (2700997)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 14TX/2FX-SM (2701466)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 8GT (2891123)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 6GT/2SFP (2891479)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 8TX-PN (2989103)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 4TX-PN (2989093)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 8TX (2989226)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 6TX/2SFP (2989323)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMN 6TX/2POF-PN (2700290)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMN 8TX-PN (2989501)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMN 6TX/2FX (2989543)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMN 6TX/2FX SM (2989556)",
"version_value": "4.70"
}
]
}
},
{
"product_name": "FL NAT",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "SMN 8TX (2989365)",
"version_value": "4.63"
},
{
"version_affected": "\u003c=",
"version_name": "SMN 8TX-M (2702443)",
"version_value": "4.63"
}
]
}
}
]
},
"vendor_name": "Phoenix Contact"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This vulnerability has been discovered and reported by Anne Borcherding, Fraunhofer- Institut f\u00fcr Optronik, Systemtechnik und Bildauswertung IOSB. PHOENIX CONTACT thanks CERT@VDE for the coordination and support with this publication."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In Phoenix Contact FL SWITCH SMCS series products in multiple versions fragmented TCP-Packets may cause a Denial of Service of Web-, SNMP- and ICMP-Echo services. The switching functionality of the device is not affected."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-404 Improper Resource Shutdown or Release"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert.vde.com/en-us/advisories/vde-2021-023",
"refsource": "CONFIRM",
"url": "https://cert.vde.com/en-us/advisories/vde-2021-023"
}
]
},
"source": {
"advisory": "VDE-2021-023",
"defect": [
"VDE-2021-023"
],
"discovery": "EXTERNAL"
},
"work_around": [
{
"lang": "en",
"value": "Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to the Phoenix Contact application note:\nMeasures to protect network-capable devices with Ethernet connection https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf"
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2021-21003",
"datePublished": "2021-06-25T18:25:51.312211Z",
"dateReserved": "2020-12-17T00:00:00",
"dateUpdated": "2024-09-17T01:31:02.647Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-21005 (GCVE-0-2021-21005)
Vulnerability from cvelistv5 – Published: 2021-06-25 18:25 – Updated: 2024-09-17 02:17
VLAI?
Title
Race Condition Vulnerability in Phoenix Contact FL SWITCH SMCS series products
Summary
In Phoenix Contact FL SWITCH SMCS series products in multiple versions if an attacker sends a hand-crafted TCP-Packet with the Urgent-Flag set and the Urgent-Pointer set to 0, the network stack will crash. The device needs to be rebooted afterwards.
Severity ?
7.5 (High)
CWE
- CWE-362 - Race Condition (Concurrent Execution using Shared Resource with Improper Synchronization)
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Phoenix Contact | FL SWITCH |
Affected:
SMCS 16TX (2700996) , ≤ 4.70
(custom)
Affected: SMCS 14TX/2FX (2700997) , ≤ 4.70 (custom) Affected: SMCS 14TX/2FX-SM (2701466) , ≤ 4.70 (custom) Affected: SMCS 8GT (2891123) , ≤ 4.70 (custom) Affected: SMCS 6GT/2SFP (2891479) , ≤ 4.70 (custom) Affected: SMCS 8TX-PN (2989103) , ≤ 4.70 (custom) Affected: SMCS 4TX-PN (2989093) , ≤ 4.70 (custom) Affected: SMCS 8TX (2989226) , ≤ 4.70 (custom) Affected: SMCS 6TX/2SFP (2989323) , ≤ 4.70 (custom) Affected: SMN 6TX/2POF-PN (2700290) , ≤ 4.70 (custom) Affected: SMN 8TX-PN (2989501) , ≤ 4.70 (custom) Affected: SMN 6TX/2FX (2989543) , ≤ 4.70 (custom) Affected: SMN 6TX/2FX SM (2989556) , ≤ 4.70 (custom) |
|||||||
|
|||||||||
Credits
This vulnerability has been discovered and reported by Anne Borcherding, Fraunhofer- Institut für Optronik, Systemtechnik und Bildauswertung IOSB. PHOENIX CONTACT thanks CERT@VDE for the coordination and support with this publication.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T17:53:23.060Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2021-023"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "FL SWITCH",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 16TX (2700996)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 14TX/2FX (2700997)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 14TX/2FX-SM (2701466)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 8GT (2891123)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 6GT/2SFP (2891479)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 8TX-PN (2989103)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 4TX-PN (2989093)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 8TX (2989226)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 6TX/2SFP (2989323)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMN 6TX/2POF-PN (2700290)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMN 8TX-PN (2989501)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMN 6TX/2FX (2989543)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMN 6TX/2FX SM (2989556)",
"versionType": "custom"
}
]
},
{
"product": "FL NAT",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThanOrEqual": "4.63",
"status": "affected",
"version": "SMN 8TX (2989365)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.63",
"status": "affected",
"version": "SMN 8TX-M (2702443)",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This vulnerability has been discovered and reported by Anne Borcherding, Fraunhofer- Institut f\u00fcr Optronik, Systemtechnik und Bildauswertung IOSB. PHOENIX CONTACT thanks CERT@VDE for the coordination and support with this publication."
}
],
"datePublic": "2021-06-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "In Phoenix Contact FL SWITCH SMCS series products in multiple versions if an attacker sends a hand-crafted TCP-Packet with the Urgent-Flag set and the Urgent-Pointer set to 0, the network stack will crash. The device needs to be rebooted afterwards."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Race Condition (Concurrent Execution using Shared Resource with Improper Synchronization)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-25T18:25:53",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2021-023"
}
],
"source": {
"advisory": "VDE-2021-023",
"defect": [
"VDE-2021-023"
],
"discovery": "EXTERNAL"
},
"title": "Race Condition Vulnerability in Phoenix Contact FL SWITCH SMCS series products",
"workarounds": [
{
"lang": "en",
"value": "Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to the Phoenix Contact application note:\nMeasures to protect network-capable devices with Ethernet connection https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf"
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "info@cert.vde.com",
"DATE_PUBLIC": "2021-06-23T10:00:00.000Z",
"ID": "CVE-2021-21005",
"STATE": "PUBLIC",
"TITLE": "Race Condition Vulnerability in Phoenix Contact FL SWITCH SMCS series products"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "FL SWITCH",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "SMCS 16TX (2700996)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 14TX/2FX (2700997)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 14TX/2FX-SM (2701466)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 8GT (2891123)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 6GT/2SFP (2891479)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 8TX-PN (2989103)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 4TX-PN (2989093)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 8TX (2989226)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 6TX/2SFP (2989323)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMN 6TX/2POF-PN (2700290)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMN 8TX-PN (2989501)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMN 6TX/2FX (2989543)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMN 6TX/2FX SM (2989556)",
"version_value": "4.70"
}
]
}
},
{
"product_name": "FL NAT",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "SMN 8TX (2989365)",
"version_value": "4.63"
},
{
"version_affected": "\u003c=",
"version_name": "SMN 8TX-M (2702443)",
"version_value": "4.63"
}
]
}
}
]
},
"vendor_name": "Phoenix Contact"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This vulnerability has been discovered and reported by Anne Borcherding, Fraunhofer- Institut f\u00fcr Optronik, Systemtechnik und Bildauswertung IOSB. PHOENIX CONTACT thanks CERT@VDE for the coordination and support with this publication."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In Phoenix Contact FL SWITCH SMCS series products in multiple versions if an attacker sends a hand-crafted TCP-Packet with the Urgent-Flag set and the Urgent-Pointer set to 0, the network stack will crash. The device needs to be rebooted afterwards."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-362 Race Condition (Concurrent Execution using Shared Resource with Improper Synchronization)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert.vde.com/en-us/advisories/vde-2021-023",
"refsource": "CONFIRM",
"url": "https://cert.vde.com/en-us/advisories/vde-2021-023"
}
]
},
"source": {
"advisory": "VDE-2021-023",
"defect": [
"VDE-2021-023"
],
"discovery": "EXTERNAL"
},
"work_around": [
{
"lang": "en",
"value": "Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to the Phoenix Contact application note:\nMeasures to protect network-capable devices with Ethernet connection https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf"
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2021-21005",
"datePublished": "2021-06-25T18:25:53.099513Z",
"dateReserved": "2020-12-17T00:00:00",
"dateUpdated": "2024-09-17T02:17:13.899Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-21004 (GCVE-0-2021-21004)
Vulnerability from cvelistv5 – Published: 2021-06-25 18:25 – Updated: 2024-09-16 22:08
VLAI?
Title
Cross-site Scripting Vulnerability in Phoenix Contact FL SWITCH SMCS series products
Summary
In Phoenix Contact FL SWITCH SMCS series products in multiple versions an attacker may insert malicious code via LLDP frames into the web-based management which could then be executed by the client.
Severity ?
7.4 (High)
CWE
- CWE-79 - Cross-site Scripting (XSS)
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Phoenix Contact | FL SWITCH |
Affected:
SMCS 16TX (2700996) , ≤ 4.70
(custom)
Affected: SMCS 14TX/2FX (2700997) , ≤ 4.70 (custom) Affected: SMCS 14TX/2FX-SM (2701466) , ≤ 4.70 (custom) Affected: SMCS 8GT (2891123) , ≤ 4.70 (custom) Affected: SMCS 6GT/2SFP (2891479) , ≤ 4.70 (custom) Affected: SMCS 8TX-PN (2989103) , ≤ 4.70 (custom) Affected: SMCS 4TX-PN (2989093) , ≤ 4.70 (custom) Affected: SMCS 8TX (2989226) , ≤ 4.70 (custom) Affected: SMCS 6TX/2SFP (2989323) , ≤ 4.70 (custom) Affected: SMN 6TX/2POF-PN (2700290) , ≤ 4.70 (custom) Affected: SMN 8TX-PN (2989501) , ≤ 4.70 (custom) Affected: SMN 6TX/2FX (2989543) , ≤ 4.70 (custom) Affected: SMN 6TX/2FX SM (2989556) , ≤ 4.70 (custom) |
|||||||
|
|||||||||
Credits
This vulnerability has been discovered and reported by Anne Borcherding, Fraunhofer- Institut für Optronik, Systemtechnik und Bildauswertung IOSB. PHOENIX CONTACT thanks CERT@VDE for the coordination and support with this publication.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T17:53:23.134Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2021-023"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "FL SWITCH",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 16TX (2700996)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 14TX/2FX (2700997)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 14TX/2FX-SM (2701466)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 8GT (2891123)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 6GT/2SFP (2891479)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 8TX-PN (2989103)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 4TX-PN (2989093)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 8TX (2989226)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 6TX/2SFP (2989323)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMN 6TX/2POF-PN (2700290)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMN 8TX-PN (2989501)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMN 6TX/2FX (2989543)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMN 6TX/2FX SM (2989556)",
"versionType": "custom"
}
]
},
{
"product": "FL NAT",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThanOrEqual": "4.63",
"status": "affected",
"version": "SMN 8TX (2989365)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.63",
"status": "affected",
"version": "SMN 8TX-M (2702443)",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This vulnerability has been discovered and reported by Anne Borcherding, Fraunhofer- Institut f\u00fcr Optronik, Systemtechnik und Bildauswertung IOSB. PHOENIX CONTACT thanks CERT@VDE for the coordination and support with this publication."
}
],
"datePublic": "2021-06-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "In Phoenix Contact FL SWITCH SMCS series products in multiple versions an attacker may insert malicious code via LLDP frames into the web-based management which could then be executed by the client."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-25T18:25:52",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2021-023"
}
],
"source": {
"advisory": "VDE-2021-023",
"defect": [
"VDE-2021-023"
],
"discovery": "EXTERNAL"
},
"title": "Cross-site Scripting Vulnerability in Phoenix Contact FL SWITCH SMCS series products",
"workarounds": [
{
"lang": "en",
"value": "Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to the Phoenix Contact application note:\nMeasures to protect network-capable devices with Ethernet connection https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf"
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "info@cert.vde.com",
"DATE_PUBLIC": "2021-06-23T10:00:00.000Z",
"ID": "CVE-2021-21004",
"STATE": "PUBLIC",
"TITLE": "Cross-site Scripting Vulnerability in Phoenix Contact FL SWITCH SMCS series products"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "FL SWITCH",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "SMCS 16TX (2700996)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 14TX/2FX (2700997)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 14TX/2FX-SM (2701466)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 8GT (2891123)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 6GT/2SFP (2891479)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 8TX-PN (2989103)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 4TX-PN (2989093)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 8TX (2989226)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 6TX/2SFP (2989323)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMN 6TX/2POF-PN (2700290)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMN 8TX-PN (2989501)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMN 6TX/2FX (2989543)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMN 6TX/2FX SM (2989556)",
"version_value": "4.70"
}
]
}
},
{
"product_name": "FL NAT",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "SMN 8TX (2989365)",
"version_value": "4.63"
},
{
"version_affected": "\u003c=",
"version_name": "SMN 8TX-M (2702443)",
"version_value": "4.63"
}
]
}
}
]
},
"vendor_name": "Phoenix Contact"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This vulnerability has been discovered and reported by Anne Borcherding, Fraunhofer- Institut f\u00fcr Optronik, Systemtechnik und Bildauswertung IOSB. PHOENIX CONTACT thanks CERT@VDE for the coordination and support with this publication."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In Phoenix Contact FL SWITCH SMCS series products in multiple versions an attacker may insert malicious code via LLDP frames into the web-based management which could then be executed by the client."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Cross-site Scripting (XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert.vde.com/en-us/advisories/vde-2021-023",
"refsource": "CONFIRM",
"url": "https://cert.vde.com/en-us/advisories/vde-2021-023"
}
]
},
"source": {
"advisory": "VDE-2021-023",
"defect": [
"VDE-2021-023"
],
"discovery": "EXTERNAL"
},
"work_around": [
{
"lang": "en",
"value": "Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to the Phoenix Contact application note:\nMeasures to protect network-capable devices with Ethernet connection https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf"
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2021-21004",
"datePublished": "2021-06-25T18:25:52.190088Z",
"dateReserved": "2020-12-17T00:00:00",
"dateUpdated": "2024-09-16T22:08:28.813Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-21003 (GCVE-0-2021-21003)
Vulnerability from cvelistv5 – Published: 2021-06-25 18:25 – Updated: 2024-09-17 01:31
VLAI?
Title
Denial of Service Vulnerability in Phoenix Contact FL SWITCH SMCS series products
Summary
In Phoenix Contact FL SWITCH SMCS series products in multiple versions fragmented TCP-Packets may cause a Denial of Service of Web-, SNMP- and ICMP-Echo services. The switching functionality of the device is not affected.
Severity ?
5.3 (Medium)
CWE
- CWE-404 - Improper Resource Shutdown or Release
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Phoenix Contact | FL SWITCH |
Affected:
SMCS 16TX (2700996) , ≤ 4.70
(custom)
Affected: SMCS 14TX/2FX (2700997) , ≤ 4.70 (custom) Affected: SMCS 14TX/2FX-SM (2701466) , ≤ 4.70 (custom) Affected: SMCS 8GT (2891123) , ≤ 4.70 (custom) Affected: SMCS 6GT/2SFP (2891479) , ≤ 4.70 (custom) Affected: SMCS 8TX-PN (2989103) , ≤ 4.70 (custom) Affected: SMCS 4TX-PN (2989093) , ≤ 4.70 (custom) Affected: SMCS 8TX (2989226) , ≤ 4.70 (custom) Affected: SMCS 6TX/2SFP (2989323) , ≤ 4.70 (custom) Affected: SMN 6TX/2POF-PN (2700290) , ≤ 4.70 (custom) Affected: SMN 8TX-PN (2989501) , ≤ 4.70 (custom) Affected: SMN 6TX/2FX (2989543) , ≤ 4.70 (custom) Affected: SMN 6TX/2FX SM (2989556) , ≤ 4.70 (custom) |
|||||||
|
|||||||||
Credits
This vulnerability has been discovered and reported by Anne Borcherding, Fraunhofer- Institut für Optronik, Systemtechnik und Bildauswertung IOSB. PHOENIX CONTACT thanks CERT@VDE for the coordination and support with this publication.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T17:53:23.063Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2021-023"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "FL SWITCH",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 16TX (2700996)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 14TX/2FX (2700997)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 14TX/2FX-SM (2701466)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 8GT (2891123)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 6GT/2SFP (2891479)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 8TX-PN (2989103)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 4TX-PN (2989093)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 8TX (2989226)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMCS 6TX/2SFP (2989323)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMN 6TX/2POF-PN (2700290)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMN 8TX-PN (2989501)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMN 6TX/2FX (2989543)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.70",
"status": "affected",
"version": "SMN 6TX/2FX SM (2989556)",
"versionType": "custom"
}
]
},
{
"product": "FL NAT",
"vendor": "Phoenix Contact",
"versions": [
{
"lessThanOrEqual": "4.63",
"status": "affected",
"version": "SMN 8TX (2989365)",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.63",
"status": "affected",
"version": "SMN 8TX-M (2702443)",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This vulnerability has been discovered and reported by Anne Borcherding, Fraunhofer- Institut f\u00fcr Optronik, Systemtechnik und Bildauswertung IOSB. PHOENIX CONTACT thanks CERT@VDE for the coordination and support with this publication."
}
],
"datePublic": "2021-06-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "In Phoenix Contact FL SWITCH SMCS series products in multiple versions fragmented TCP-Packets may cause a Denial of Service of Web-, SNMP- and ICMP-Echo services. The switching functionality of the device is not affected."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "CWE-404 Improper Resource Shutdown or Release",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-25T18:25:51",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2021-023"
}
],
"source": {
"advisory": "VDE-2021-023",
"defect": [
"VDE-2021-023"
],
"discovery": "EXTERNAL"
},
"title": "Denial of Service Vulnerability in Phoenix Contact FL SWITCH SMCS series products",
"workarounds": [
{
"lang": "en",
"value": "Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to the Phoenix Contact application note:\nMeasures to protect network-capable devices with Ethernet connection https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf"
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "info@cert.vde.com",
"DATE_PUBLIC": "2021-06-23T10:00:00.000Z",
"ID": "CVE-2021-21003",
"STATE": "PUBLIC",
"TITLE": "Denial of Service Vulnerability in Phoenix Contact FL SWITCH SMCS series products"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "FL SWITCH",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "SMCS 16TX (2700996)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 14TX/2FX (2700997)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 14TX/2FX-SM (2701466)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 8GT (2891123)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 6GT/2SFP (2891479)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 8TX-PN (2989103)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 4TX-PN (2989093)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 8TX (2989226)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMCS 6TX/2SFP (2989323)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMN 6TX/2POF-PN (2700290)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMN 8TX-PN (2989501)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMN 6TX/2FX (2989543)",
"version_value": "4.70"
},
{
"version_affected": "\u003c=",
"version_name": "SMN 6TX/2FX SM (2989556)",
"version_value": "4.70"
}
]
}
},
{
"product_name": "FL NAT",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "SMN 8TX (2989365)",
"version_value": "4.63"
},
{
"version_affected": "\u003c=",
"version_name": "SMN 8TX-M (2702443)",
"version_value": "4.63"
}
]
}
}
]
},
"vendor_name": "Phoenix Contact"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This vulnerability has been discovered and reported by Anne Borcherding, Fraunhofer- Institut f\u00fcr Optronik, Systemtechnik und Bildauswertung IOSB. PHOENIX CONTACT thanks CERT@VDE for the coordination and support with this publication."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In Phoenix Contact FL SWITCH SMCS series products in multiple versions fragmented TCP-Packets may cause a Denial of Service of Web-, SNMP- and ICMP-Echo services. The switching functionality of the device is not affected."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-404 Improper Resource Shutdown or Release"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert.vde.com/en-us/advisories/vde-2021-023",
"refsource": "CONFIRM",
"url": "https://cert.vde.com/en-us/advisories/vde-2021-023"
}
]
},
"source": {
"advisory": "VDE-2021-023",
"defect": [
"VDE-2021-023"
],
"discovery": "EXTERNAL"
},
"work_around": [
{
"lang": "en",
"value": "Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to the Phoenix Contact application note:\nMeasures to protect network-capable devices with Ethernet connection https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf"
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2021-21003",
"datePublished": "2021-06-25T18:25:51.312211Z",
"dateReserved": "2020-12-17T00:00:00",
"dateUpdated": "2024-09-17T01:31:02.647Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}