CVE-2021-34563

CVE-2021-34563 affects Pepperl+Fuchs WirelessHART-Gateway versions 3.0.8 and 3.0.9. The HttpOnly flag is not set on a cookie, allowing its value to be read or modified by client-side JavaScript. The documented impact is limited to information leakage/ alteration via cookie access, with CVSSv3 bas...

CVE-2021-34563 In WirelessHART-Gateway versions 3.0.8 and 3.0.9 the HttpOnly flag is missing in a cookie which allows client-side javascript to modify it

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie. This allows the cookie's value to be read or set by client-side JavaScript...

CVE-2021-34562 A vulnerability in WirelessHART-Gateway 3.0.8 it is possible to inject arbitrary JavaScript into the application's response

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 it is possible to inject arbitrary JavaScript into the application's response...

CVE-2021-34562

CVE-2021-34562 affects Pepperl+Fuchs WirelessHART-Gateway, notably versions 3.0.7–3.0.9 (3.0.8 highlighted). The vulnerability allows injection of arbitrary JavaScript into the application’s response (a cross-site scripting-type issue) as described in the ICSA advisory and CVE records. The primar...

CVE-2021-34561 A vulnerability in WirelessHART-Gateway <= 3.0.8 allows to bypass any IP or firewall based access restrictions through DNS rebinding

In PEPPERL+FUCHS WirelessHART-Gateway = 3.0.8 serious issue exists, if the application is not externally accessible or uses IP-based access restrictions. Attackers can use DNS Rebinding to bypass any IP or firewall based access restrictions that may be in place, by proxying through their target's...

CVE-2021-34561

The CVE affects Pepperl+Fuchs WirelessHART-Gateway (versions 3.0.7–3.0.8, with related advisories extending to 3.0.9) where DNS rebinding can bypass IP/firewall access controls by proxying through a target’s browser. Root cause: reliance on DNS-based access controls; impact includes potential una...

CVE-2021-34560 A vulnerability in WirelessHART-Gateway <= 3.0.9 could lead to information exposure of sensitive information

In PEPPERL+FUCHS WirelessHART-Gateway = 3.0.9 a form contains a password field with autocomplete enabled. The stored credentials can be captured by an attacker who gains control over the user's computer. Therefore the user must have logged in at least once...

CVE-2021-34560

CVE-2021-34560 affects Pepperl+Fuchs WirelessHART-Gateway (versions

CVE-2021-34559

The CVE-2021-34559 vulnerability affects Pepperl+Fuchs WirelessHART-Gateway versions 3.0.8 and earlier. A remote attacker may rewrite links and URLs in cached pages to arbitrary strings. Public documentation lists the issue as an environmental/web-page manipulation vulnerability affecting 3.0.7–3...

CVE-2021-34559 A vulnerability in WirelessHART-Gateway <= 3.0.8 may allow remote attackers to rewrite links and URLs in cached pages to arbitrary strings

In PEPPERL+FUCHS WirelessHART-Gateway = 3.0.8 a vulnerability may allow remote attackers to rewrite links and URLs in cached pages to arbitrary strings...

CVE-2021-33555 A vulnerability may allow remote attackers to read arbitrary files on the server of the WirelessHART-Gateway

In PEPPERL+FUCHS WirelessHART-Gateway = 3.0.7 the filename parameter is vulnerable to unauthenticated path traversal attacks, enabling read access to arbitrary files on the server...

CVE-2021-33555

Summary (CVE-2021-33555) : The Pepperl+Fuchs WirelessHART-Gateway (

CVE-2021-34565: Use of Hard-coded Credentials

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.7 to 3.0.9 the SSH and telnet services are active with hard-coded credentials...

CVE-2021-34564: Cleartext Storage of Sensitive Information in a Cookie

Any cookie-stealing vulnerabilities within the application or browser would enable an attacker to steal the user's credentials to the PEPPERL+FUCHS WirelessHART-Gateway 3.0.9...

CVE-2021-34561: Reliance on Reverse DNS Resolution for a Security-Critical Action

In PEPPERL+FUCHS WirelessHART-Gateway = 3.0.8 serious issue exists, if the application is not externally accessible or uses IP-based access restrictions. Attackers can use DNS Rebinding to bypass any IP or firewall based access restrictions that may be in place, by proxying through their target's...

CVE-2021-34563: Sensitive Cookie Without 'HttpOnly' Flag

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie. This allows the cookie's value to be read or set by client-side JavaScript...

CVE-2021-34562: Improper Neutralization of Input During Web Page Generation

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 it is possible to inject arbitrary JavaScript into the application's response...

CVE-2021-34560: Insufficiently Protected Credentials

In PEPPERL+FUCHS WirelessHART-Gateway = 3.0.9 a form contains a password field with autocomplete enabled. The stored credentials can be captured by an attacker who gains control over the user's computer. Therefore the user must have logged in at least once...

CVE-2021-34559: Inconsistent Interpretation of HTTP Requests

In PEPPERL+FUCHS WirelessHART-Gateway = 3.0.8 a vulnerability may allow remote attackers to rewrite links and URLs in cached pages to arbitrary strings...

PT-2021-20549

Name of the Vulnerable Software and Affected Versions: PEPPERL+FUCHS WirelessHART-Gateway version 3.0.9 Description: The issue allows an attacker to steal user credentials by exploiting cookie-stealing vulnerabilities within the application or browser. This could enable unauthorized access to the...