Lucene search

[email protected]CVE-2021-34570

HistorySep 27, 2021 - 9:15 a.m.

CVE-2021-34570

2021-09-2709:15:00

CWE-20

[email protected]

web.nvd.nist.gov

cve-2021-34570

phoenix contact

plcnext

dos attack

json requests

nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.4 High

AI Score

Confidence

High

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

0.001 Low

EPSS

Percentile

42.3%

JSON

Multiple Phoenix Contact PLCnext control devices in versions prior to 2021.0.5 LTS are prone to a DoS attack through special crafted JSON requests.

CPENameOperatorVersion
phoenixcontact:plcnext_technology_starterkit_firmwarephoenixcontact plcnext technology starterkit firmwarelt2021.0.5
phoenixcontact:axc_f_2152_starterkit_firmwarephoenixcontact axc f 2152 starterkit firmwarelt2021.0.5
phoenixcontact:rfc_4072s_firmwarephoenixcontact rfc 4072s firmwarelt2021.0.5
phoenixcontact:axc_f_3152_firmwarephoenixcontact axc f 3152 firmwarelt2021.0.5
phoenixcontact:axc_f_1152_firmwarephoenixcontact axc f 1152 firmwarelt2021.0.5
phoenixcontact:axc_f_2152_firmwarephoenixcontact axc f 2152 firmwarelt2021.0.5

CPE	Name	Operator	Version
phoenixcontact:plcnext_technology_starterkit_firmware	phoenixcontact plcnext technology starterkit firmware	lt	2021.0.5
phoenixcontact:axc_f_2152_starterkit_firmware	phoenixcontact axc f 2152 starterkit firmware	lt	2021.0.5
phoenixcontact:rfc_4072s_firmware	phoenixcontact rfc 4072s firmware	lt	2021.0.5
phoenixcontact:axc_f_3152_firmware	phoenixcontact axc f 3152 firmware	lt	2021.0.5
phoenixcontact:axc_f_1152_firmware	phoenixcontact axc f 1152 firmware	lt	2021.0.5
phoenixcontact:axc_f_2152_firmware	phoenixcontact axc f 2152 firmware	lt	2021.0.5

References

cert.vde.com/en/advisories/VDE-2021-029/

Social References

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.4 High

AI Score

Confidence

High

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

0.001 Low

EPSS

Percentile

42.3%

JSON

Related for CVE-2021-34570

cvelist1 prion1 nessus1