Lucene search

CERTVDECVE-2021-33541

HistoryJun 25, 2021 - 7:15 p.m.

CVE-2021-33541

2021-06-2519:15:09

CWE-770

CERTVDE

web.nvd.nist.gov

cve-2021-33541

phoenix contact

ilc1x0

ilc1x1

dos

denial of service

vulnerability

communication protocols

authentication

remote attack

plc

network communication

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.4

Confidence

High

EPSS

0.002

Percentile

60.0%

JSON

Phoenix Contact Classic Line Controllers ILC1x0 and ILC1x1 in all versions/variants are affected by a Denial-of-Service vulnerability. The communication protocols and device access do not feature authentication measures. Remote attackers can use specially crafted IP packets to cause a denial of service on the PLC’s network communication module. A successful attack stops all network communication. To restore the network connectivity the device needs to be restarted. The automation task is not affected.

Affected configurations

Nvd

Node

phoenixcontactilc1x0_firmware

AND

phoenixcontactilc1x0Match-

Node

phoenixcontactilc1x1_firmware

AND

phoenixcontactilc1x1Match-

VendorProductVersionCPE
phoenixcontactilc1x0_firmware*cpe:2.3:o:phoenixcontact:ilc1x0_firmware:*:*:*:*:*:*:*:*
phoenixcontactilc1x0-cpe:2.3:h:phoenixcontact:ilc1x0:-:*:*:*:*:*:*:*
phoenixcontactilc1x1_firmware*cpe:2.3:o:phoenixcontact:ilc1x1_firmware:*:*:*:*:*:*:*:*
phoenixcontactilc1x1-cpe:2.3:h:phoenixcontact:ilc1x1:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
phoenixcontact	ilc1x0_firmware	*	cpe:2.3:o:phoenixcontact:ilc1x0_firmware::::::::
phoenixcontact	ilc1x0	-	cpe:2.3:h:phoenixcontact:ilc1x0:-:::::::*
phoenixcontact	ilc1x1_firmware	*	cpe:2.3:o:phoenixcontact:ilc1x1_firmware::::::::
phoenixcontact	ilc1x1	-	cpe:2.3:h:phoenixcontact:ilc1x1:-:::::::*

CNA Affected

[
  {
    "product": "ILC1x",
    "vendor": "Phoenix Contact",
    "versions": [
      {
        "status": "affected",
        "version": "ILC1x0 all variants"
      },
      {
        "status": "affected",
        "version": "ILC1x1 all variants"
      }
    ]
  }
]

References

cert.vde.com/en-us/advisories/vde-2021-019

Social References

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.4

Confidence

High

EPSS

0.002

Percentile

60.0%

JSON

Related for CVE-2021-33541