Lucene search

[email protected]CVE-2021-21004

HistoryJun 25, 2021 - 7:15 p.m.

CVE-2021-21004

2021-06-2519:15:08

CWE-79

[email protected]

web.nvd.nist.gov

phoenix contact

fl switch

smcs

remote code execution

lldp frames

web-based management

cve-2021-21004

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

7.4 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.1%

JSON

In Phoenix Contact FL SWITCH SMCS series products in multiple versions an attacker may insert malicious code via LLDP frames into the web-based management which could then be executed by the client.

Affected configurations

NVD

Node

phoenixcontactfl_switch_smcs_16tx_firmwareRange≤4.70

AND

phoenixcontactfl_switch_smcs_16txMatch-

Node

phoenixcontactfl_switch_smcs_14tx\/2fx_firmwareRange≤4.70

AND

phoenixcontactfl_switch_smcs_14tx\/2fxMatch-

Node

phoenixcontactfl_switch_smcs_14tx\/2fx-sm_firmwareRange≤4.70

AND

phoenixcontactfl_switch_smcs_14tx\/2fx-smMatch-

Node

phoenixcontactfl_switch_smcs_8gt_firmwareRange≤4.70

AND

phoenixcontactfl_switch_smcs_8gtMatch-

Node

phoenixcontactfl_switch_smcs_6gt\/2sfp_firmwareRange≤4.70

AND

phoenixcontactfl_switch_smcs_6gt\/2sfpMatch-

Node

phoenixcontactfl_switch_smcs_8tx-pn_firmwareRange≤4.70

AND

phoenixcontactfl_switch_smcs_8tx-pnMatch-

Node

phoenixcontactfl_switch_smcs_4tx-pn_firmwareRange≤4.70

AND

phoenixcontactfl_switch_smcs_4tx-pnMatch-

Node

phoenixcontactfl_switch_smcs_8tx_firmwareRange≤4.70

AND

phoenixcontactfl_switch_smcs_8txMatch-

Node

phoenixcontactfl_switch_smcs_6tx\/2sfp_firmwareRange≤4.70

AND

phoenixcontactfl_switch_smcs_6tx\/2sfpMatch-

Node

phoenixcontactfl_switch_smn_6tx\/2pof-pn_firmwareRange≤4.70

AND

phoenixcontactfl_switch_smn_6tx\/2pof-pnMatch-

Node

phoenixcontactfl_switch_smn_8tx-pn_firmwareRange≤4.70

AND

phoenixcontactfl_switch_smn_8tx-pnMatch-

Node

phoenixcontactfl_switch_smn_6tx\/2fx_firmwareRange≤4.70

AND

phoenixcontactfl_switch_smn_6tx\/2fxMatch-

Node

phoenixcontactfl_switch_smn_6tx\/2fx_sm_firmwareRange≤4.70

AND

phoenixcontactfl_switch_smn_6tx\/2fx_smMatch-

Node

phoenixcontactfl_nat_smn_8tx_firmwareRange≤4.63

AND

phoenixcontactfl_nat_smn_8txMatch-

Node

phoenixcontactfl_nat_smn_8tx-m_firmwareRange≤4.63

AND

phoenixcontactfl_nat_smn_8tx-mMatch-

CPENameOperatorVersion
phoenixcontact:fl_switch_smcs_16tx_firmwarephoenixcontact fl switch smcs 16tx firmwarele4.70

CPE	Name	Operator	Version
phoenixcontact:fl_switch_smcs_16tx_firmware	phoenixcontact fl switch smcs 16tx firmware	le	4.70

CNA Affected

[
  {
    "product": "FL SWITCH",
    "vendor": "Phoenix Contact",
    "versions": [
      {
        "lessThanOrEqual": "4.70",
        "status": "affected",
        "version": "SMCS 16TX (2700996)",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.70",
        "status": "affected",
        "version": "SMCS 14TX/2FX (2700997)",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.70",
        "status": "affected",
        "version": "SMCS 14TX/2FX-SM (2701466)",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.70",
        "status": "affected",
        "version": "SMCS 8GT (2891123)",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.70",
        "status": "affected",
        "version": "SMCS 6GT/2SFP (2891479)",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.70",
        "status": "affected",
        "version": "SMCS 8TX-PN (2989103)",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.70",
        "status": "affected",
        "version": "SMCS 4TX-PN (2989093)",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.70",
        "status": "affected",
        "version": "SMCS 8TX (2989226)",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.70",
        "status": "affected",
        "version": "SMCS 6TX/2SFP (2989323)",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.70",
        "status": "affected",
        "version": "SMN 6TX/2POF-PN (2700290)",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.70",
        "status": "affected",
        "version": "SMN 8TX-PN (2989501)",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.70",
        "status": "affected",
        "version": "SMN 6TX/2FX (2989543)",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.70",
        "status": "affected",
        "version": "SMN 6TX/2FX SM (2989556)",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "FL NAT",
    "vendor": "Phoenix Contact",
    "versions": [
      {
        "lessThanOrEqual": "4.63",
        "status": "affected",
        "version": "SMN 8TX (2989365)",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.63",
        "status": "affected",
        "version": "SMN 8TX-M (2702443)",
        "versionType": "custom"
      }
    ]
  }
]

References

cert.vde.com/en-us/advisories/vde-2021-023

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

7.4 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.1%

JSON

Related for CVE-2021-21004

cvelist1 prion1 nvd1