Vulnerability-Lookup

FKIE_CVE-2021-21004

Vulnerability from fkie_nvd - Published: 2021-06-25 19:15 - Updated: 2024-11-21 05:47

Severity ?

7.4 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

In Phoenix Contact FL SWITCH SMCS series products in multiple versions an attacker may insert malicious code via LLDP frames into the web-based management which could then be executed by the client.

References

	URL	Tags
	info@cert.vde.com	https://cert.vde.com/en-us/advisories/vde-2021-023	Not Applicable, Third Party Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://cert.vde.com/en-us/advisories/vde-2021-023	Not Applicable, Third Party Advisory

Impacted products

Vendor	Product	Version
phoenixcontact	fl_switch_smcs_16tx_firmware	*
phoenixcontact	fl_switch_smcs_16tx	-
phoenixcontact	fl_switch_smcs_14tx\/2fx_firmware	*
phoenixcontact	fl_switch_smcs_14tx\/2fx	-
phoenixcontact	fl_switch_smcs_14tx\/2fx-sm_firmware	*
phoenixcontact	fl_switch_smcs_14tx\/2fx-sm	-
phoenixcontact	fl_switch_smcs_8gt_firmware	*
phoenixcontact	fl_switch_smcs_8gt	-
phoenixcontact	fl_switch_smcs_6gt\/2sfp_firmware	*
phoenixcontact	fl_switch_smcs_6gt\/2sfp	-
phoenixcontact	fl_switch_smcs_8tx-pn_firmware	*
phoenixcontact	fl_switch_smcs_8tx-pn	-
phoenixcontact	fl_switch_smcs_4tx-pn_firmware	*
phoenixcontact	fl_switch_smcs_4tx-pn	-
phoenixcontact	fl_switch_smcs_8tx_firmware	*
phoenixcontact	fl_switch_smcs_8tx	-
phoenixcontact	fl_switch_smcs_6tx\/2sfp_firmware	*
phoenixcontact	fl_switch_smcs_6tx\/2sfp	-
phoenixcontact	fl_switch_smn_6tx\/2pof-pn_firmware	*
phoenixcontact	fl_switch_smn_6tx\/2pof-pn	-
phoenixcontact	fl_switch_smn_8tx-pn_firmware	*
phoenixcontact	fl_switch_smn_8tx-pn	-
phoenixcontact	fl_switch_smn_6tx\/2fx_firmware	*
phoenixcontact	fl_switch_smn_6tx\/2fx	-
phoenixcontact	fl_switch_smn_6tx\/2fx_sm_firmware	*
phoenixcontact	fl_switch_smn_6tx\/2fx_sm	-
phoenixcontact	fl_nat_smn_8tx_firmware	*
phoenixcontact	fl_nat_smn_8tx	-
phoenixcontact	fl_nat_smn_8tx-m_firmware	*
phoenixcontact	fl_nat_smn_8tx-m	-

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:phoenixcontact:fl_switch_smcs_16tx_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4CDDEB10-788C-415A-9755-64C162201992",
              "versionEndIncluding": "4.70",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:phoenixcontact:fl_switch_smcs_16tx:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "51C916CC-15CA-4F7F-83BC-4DB2C29A993C",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:phoenixcontact:fl_switch_smcs_14tx\\/2fx_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CA89CC68-7F88-4ACB-B78F-1F8CDB4E66E2",
              "versionEndIncluding": "4.70",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:phoenixcontact:fl_switch_smcs_14tx\\/2fx:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F857640B-80AC-4474-8315-60703D28EB84",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:phoenixcontact:fl_switch_smcs_14tx\\/2fx-sm_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "334E6016-A7D5-44E4-A118-2133B6CA406F",
              "versionEndIncluding": "4.70",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:phoenixcontact:fl_switch_smcs_14tx\\/2fx-sm:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "25EEA47E-625E-43AB-8D71-F068675A9E88",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:phoenixcontact:fl_switch_smcs_8gt_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F54B5E21-F02B-4AE6-862F-3E419B9C765A",
              "versionEndIncluding": "4.70",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:phoenixcontact:fl_switch_smcs_8gt:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9E319EE0-0BE2-4C24-A426-26903F4D9924",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:phoenixcontact:fl_switch_smcs_6gt\\/2sfp_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C3D06010-FACB-44C2-9737-88FAA6693DA8",
              "versionEndIncluding": "4.70",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:phoenixcontact:fl_switch_smcs_6gt\\/2sfp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2E1196AA-CD50-4799-86A2-DED0D56CB53A",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:phoenixcontact:fl_switch_smcs_8tx-pn_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3B549DAB-C568-4E08-89F9-971B1DFBF008",
              "versionEndIncluding": "4.70",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:phoenixcontact:fl_switch_smcs_8tx-pn:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D38E31A8-E0A9-4BE1-ADD9-5660E5392B9E",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:phoenixcontact:fl_switch_smcs_4tx-pn_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "16769058-19DC-4851-9AC9-2BB1C205E32F",
              "versionEndIncluding": "4.70",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:phoenixcontact:fl_switch_smcs_4tx-pn:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8A1C4B35-EE9B-4EAC-8A9B-E8188D3EB4EA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:phoenixcontact:fl_switch_smcs_8tx_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A86969BA-3F9C-424A-A003-95F537B63172",
              "versionEndIncluding": "4.70",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:phoenixcontact:fl_switch_smcs_8tx:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9EBF53F7-0B39-4E8A-B1F8-C99CAA062DF5",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:phoenixcontact:fl_switch_smcs_6tx\\/2sfp_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A5AF58FC-0E28-467D-8167-C3DB6BE47C3E",
              "versionEndIncluding": "4.70",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:phoenixcontact:fl_switch_smcs_6tx\\/2sfp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C98B0801-5CD9-4276-8E39-65C2DD5923BF",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:phoenixcontact:fl_switch_smn_6tx\\/2pof-pn_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4AE6705F-13EF-4685-9E62-D0E94C863A75",
              "versionEndIncluding": "4.70",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:phoenixcontact:fl_switch_smn_6tx\\/2pof-pn:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "49EFD53E-6260-4B04-B866-8C7757FFE339",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:phoenixcontact:fl_switch_smn_8tx-pn_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7E7F051D-0EA6-442F-9470-D916971C45C0",
              "versionEndIncluding": "4.70",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:phoenixcontact:fl_switch_smn_8tx-pn:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E0289C54-7F31-4777-AD97-3D5CEF5E8E69",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:phoenixcontact:fl_switch_smn_6tx\\/2fx_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "990CECCE-C438-4BDC-BCD9-D0BBA7E4C6F8",
              "versionEndIncluding": "4.70",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:phoenixcontact:fl_switch_smn_6tx\\/2fx:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EC332621-9FEC-40E0-AE7A-76F13F7FCE57",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:phoenixcontact:fl_switch_smn_6tx\\/2fx_sm_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F11861A4-B692-4781-B4CA-B48BE7ECD212",
              "versionEndIncluding": "4.70",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:phoenixcontact:fl_switch_smn_6tx\\/2fx_sm:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "01FD1C84-FFD7-48A1-8EC2-7D6AC4896266",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:phoenixcontact:fl_nat_smn_8tx_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0EFA2320-2E1C-49FC-BF70-12BE51770537",
              "versionEndIncluding": "4.63",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:phoenixcontact:fl_nat_smn_8tx:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "427C31A9-C301-4B24-808D-B46E054557D6",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:phoenixcontact:fl_nat_smn_8tx-m_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CC296B35-23D1-4AE8-AC95-E636A0523C66",
              "versionEndIncluding": "4.63",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:phoenixcontact:fl_nat_smn_8tx-m:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E8E560F4-EB19-4A41-A3CC-F88F7BA3BD65",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Phoenix Contact FL SWITCH SMCS series products in multiple versions an attacker may insert malicious code via LLDP frames into the web-based management which could then be executed by the client."
    },
    {
      "lang": "es",
      "value": "En los productos de la serie Phoenix Contact FL SWITCH SMCS en m\u00faltiples versiones, un atacante puede insertar c\u00f3digo malicioso por medio de tramas LLDP en la administraci\u00f3n basada en la web, que luego podr\u00eda ser ejecutado por el cliente"
    }
  ],
  "id": "CVE-2021-21004",
  "lastModified": "2024-11-21T05:47:23.160",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 4.7,
        "source": "info@cert.vde.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-06-25T19:15:08.730",
  "references": [
    {
      "source": "info@cert.vde.com",
      "tags": [
        "Not Applicable",
        "Third Party Advisory"
      ],
      "url": "https://cert.vde.com/en-us/advisories/vde-2021-023"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Not Applicable",
        "Third Party Advisory"
      ],
      "url": "https://cert.vde.com/en-us/advisories/vde-2021-023"
    }
  ],
  "sourceIdentifier": "info@cert.vde.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "info@cert.vde.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2021-21004 (GCVE-0-2021-21004)

Vulnerability from cvelistv5 – Published: 2021-06-25 18:25 – Updated: 2024-09-16 22:08

Title

Cross-site Scripting Vulnerability in Phoenix Contact FL SWITCH SMCS series products

Summary

In Phoenix Contact FL SWITCH SMCS series products in multiple versions an attacker may insert malicious code via LLDP frames into the web-based management which could then be executed by the client.

Severity ?

7.4 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

CWE

CWE-79 - Cross-site Scripting (XSS)

Assigner

CERTVDE

References

URL

Tags

https://cert.vde.com/en-us/advisories/vde-2021-023

x_refsource_CONFIRM

Impacted products

Vendor

Product

Version

Phoenix Contact

FL SWITCH

Affected: SMCS 16TX (2700996) , ≤ 4.70 (custom)
Affected: SMCS 14TX/2FX (2700997) , ≤ 4.70 (custom)
Affected: SMCS 14TX/2FX-SM (2701466) , ≤ 4.70 (custom)
Affected: SMCS 8GT (2891123) , ≤ 4.70 (custom)
Affected: SMCS 6GT/2SFP (2891479) , ≤ 4.70 (custom)
Affected: SMCS 8TX-PN (2989103) , ≤ 4.70 (custom)
Affected: SMCS 4TX-PN (2989093) , ≤ 4.70 (custom)
Affected: SMCS 8TX (2989226) , ≤ 4.70 (custom)
Affected: SMCS 6TX/2SFP (2989323) , ≤ 4.70 (custom)
Affected: SMN 6TX/2POF-PN (2700290) , ≤ 4.70 (custom)
Affected: SMN 8TX-PN (2989501) , ≤ 4.70 (custom)
Affected: SMN 6TX/2FX (2989543) , ≤ 4.70 (custom)
Affected: SMN 6TX/2FX SM (2989556) , ≤ 4.70 (custom)

Phoenix Contact

FL NAT

Affected: SMN 8TX (2989365) , ≤ 4.63 (custom)
Affected: SMN 8TX-M (2702443) , ≤ 4.63 (custom)

Credits

This vulnerability has been discovered and reported by Anne Borcherding, Fraunhofer- Institut für Optronik, Systemtechnik und Bildauswertung IOSB. PHOENIX CONTACT thanks CERT@VDE for the coordination and support with this publication.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:53:23.134Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert.vde.com/en-us/advisories/vde-2021-023"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FL SWITCH",
          "vendor": "Phoenix Contact",
          "versions": [
            {
              "lessThanOrEqual": "4.70",
              "status": "affected",
              "version": "SMCS 16TX (2700996)",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.70",
              "status": "affected",
              "version": "SMCS 14TX/2FX (2700997)",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.70",
              "status": "affected",
              "version": "SMCS 14TX/2FX-SM (2701466)",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.70",
              "status": "affected",
              "version": "SMCS 8GT (2891123)",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.70",
              "status": "affected",
              "version": "SMCS 6GT/2SFP (2891479)",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.70",
              "status": "affected",
              "version": "SMCS 8TX-PN (2989103)",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.70",
              "status": "affected",
              "version": "SMCS 4TX-PN (2989093)",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.70",
              "status": "affected",
              "version": "SMCS 8TX (2989226)",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.70",
              "status": "affected",
              "version": "SMCS 6TX/2SFP (2989323)",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.70",
              "status": "affected",
              "version": "SMN 6TX/2POF-PN (2700290)",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.70",
              "status": "affected",
              "version": "SMN 8TX-PN (2989501)",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.70",
              "status": "affected",
              "version": "SMN 6TX/2FX (2989543)",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.70",
              "status": "affected",
              "version": "SMN 6TX/2FX SM (2989556)",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "FL NAT",
          "vendor": "Phoenix Contact",
          "versions": [
            {
              "lessThanOrEqual": "4.63",
              "status": "affected",
              "version": "SMN 8TX (2989365)",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.63",
              "status": "affected",
              "version": "SMN 8TX-M (2702443)",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "This vulnerability has been discovered and reported by Anne Borcherding, Fraunhofer- Institut f\u00fcr Optronik, Systemtechnik und Bildauswertung IOSB. PHOENIX CONTACT thanks CERT@VDE for the coordination and support with this publication."
        }
      ],
      "datePublic": "2021-06-23T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "In Phoenix Contact FL SWITCH SMCS series products in multiple versions an attacker may insert malicious code via LLDP frames into the web-based management which could then be executed by the client."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-25T18:25:52",
        "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
        "shortName": "CERTVDE"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert.vde.com/en-us/advisories/vde-2021-023"
        }
      ],
      "source": {
        "advisory": "VDE-2021-023",
        "defect": [
          "VDE-2021-023"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Cross-site Scripting Vulnerability in Phoenix Contact FL SWITCH SMCS series products",
      "workarounds": [
        {
          "lang": "en",
          "value": "Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to the Phoenix Contact application note:\nMeasures to protect network-capable devices with Ethernet connection https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "info@cert.vde.com",
          "DATE_PUBLIC": "2021-06-23T10:00:00.000Z",
          "ID": "CVE-2021-21004",
          "STATE": "PUBLIC",
          "TITLE": "Cross-site Scripting Vulnerability in Phoenix Contact FL SWITCH SMCS series products"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "FL SWITCH",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "SMCS 16TX (2700996)",
                            "version_value": "4.70"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "SMCS 14TX/2FX (2700997)",
                            "version_value": "4.70"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "SMCS 14TX/2FX-SM (2701466)",
                            "version_value": "4.70"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "SMCS 8GT (2891123)",
                            "version_value": "4.70"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "SMCS 6GT/2SFP (2891479)",
                            "version_value": "4.70"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "SMCS 8TX-PN (2989103)",
                            "version_value": "4.70"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "SMCS 4TX-PN (2989093)",
                            "version_value": "4.70"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "SMCS 8TX (2989226)",
                            "version_value": "4.70"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "SMCS 6TX/2SFP (2989323)",
                            "version_value": "4.70"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "SMN 6TX/2POF-PN (2700290)",
                            "version_value": "4.70"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "SMN 8TX-PN (2989501)",
                            "version_value": "4.70"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "SMN 6TX/2FX (2989543)",
                            "version_value": "4.70"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "SMN 6TX/2FX SM (2989556)",
                            "version_value": "4.70"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "FL NAT",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "SMN 8TX (2989365)",
                            "version_value": "4.63"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "SMN 8TX-M (2702443)",
                            "version_value": "4.63"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Phoenix Contact"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "This vulnerability has been discovered and reported by Anne Borcherding, Fraunhofer- Institut f\u00fcr Optronik, Systemtechnik und Bildauswertung IOSB. PHOENIX CONTACT thanks CERT@VDE for the coordination and support with this publication."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Phoenix Contact FL SWITCH SMCS series products in multiple versions an attacker may insert malicious code via LLDP frames into the web-based management which could then be executed by the client."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Cross-site Scripting (XSS)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://cert.vde.com/en-us/advisories/vde-2021-023",
              "refsource": "CONFIRM",
              "url": "https://cert.vde.com/en-us/advisories/vde-2021-023"
            }
          ]
        },
        "source": {
          "advisory": "VDE-2021-023",
          "defect": [
            "VDE-2021-023"
          ],
          "discovery": "EXTERNAL"
        },
        "work_around": [
          {
            "lang": "en",
            "value": "Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to the Phoenix Contact application note:\nMeasures to protect network-capable devices with Ethernet connection https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf"
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
    "assignerShortName": "CERTVDE",
    "cveId": "CVE-2021-21004",
    "datePublished": "2021-06-25T18:25:52.190088Z",
    "dateReserved": "2020-12-17T00:00:00",
    "dateUpdated": "2024-09-16T22:08:28.813Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

FKIE_CVE-2021-21004

CVE-2021-21004 (GCVE-0-2021-21004)

Tags

Sightings

Nomenclature