Lucene search

CERTVDECVELIST:CVE-2021-34579

HistoryNov 09, 2022 - 4:28 p.m.

CVE-2021-34579 PHOENIX CONTACT: FL MGUARD DM version 1.12.0 and 1.13.0 Improper Privilege Management

2022-11-0916:28:32

CWE-269

CERTVDE

www.cve.org

phoenix contact

fl mguard dm

improper privilege management

apache web server

microsoft windows

atv profiles

ipsec vpn connections

cve-2021-34579

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

51.4%

JSON

In Phoenix Contact: FL MGUARD DM version 1.12.0 and 1.13.0 access to the Apache web server being installed as part of the FL MGUARD DM on Microsoft Windows does not require login credentials even if configured during installation.Attackers with network access to the Apache web server can download and therefore read mGuard configuration profiles (“ATV profiles”). Such configuration profiles may contain sensitive information, e.g. private keys associated with IPsec VPN connections.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "FL MGUARD DM (2981974)",
    "vendor": "PHOENIX CONTACT",
    "versions": [
      {
        "status": "affected",
        "version": "1.12.0"
      },
      {
        "status": "affected",
        "version": "1.13.0"
      }
    ]
  }
]

References

cert.vde.com/en/advisories/VDE-2021-035/

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

51.4%

JSON

Related for CVELIST:CVE-2021-34579