CVE-2021-21003

In Phoenix Contact FL SWITCH SMCS series products in multiple versions fragmented TCP-Packets may cause a Denial of Service of Web-, SNMP- and ICMP-Echo services. The switching functionality of the device is not affected...

Code injection

In Phoenix Contact FL SWITCH SMCS series products in multiple versions fragmented TCP-Packets may cause a Denial of Service of Web-, SNMP- and ICMP-Echo services. The switching functionality of the device is not affected...

Authentication flaw

Phoenix Contact Classic Line Controllers ILC1x0 and ILC1x1 in all versions/variants are affected by a Denial-of-Service vulnerability. The communication protocols and device access do not feature authentication measures. Remote attackers can use specially crafted IP packets to cause a denial of...

Code injection

In Phoenix Contact FL SWITCH SMCS series products in multiple versions an attacker may insert malicious code via LLDP frames into the web-based management which could then be executed by the client...

Remote code execution

Phoenix Contact Classic Automation Worx Software Suite in Version 1.87 and below is affected by a remote code execution vulnerability. Manipulated PC Worx or Config+ projects could lead to a remote code execution when unallocated memory is freed because of incompletely initialized data. The...

Design/Logic Flaw

In Phoenix Contact FL SWITCH SMCS series products in multiple versions if an attacker sends a hand-crafted TCP-Packet with the Urgent-Flag set and the Urgent-Pointer set to 0, the network stack will crash. The device needs to be rebooted afterwards...

Design/Logic Flaw

In certain devices of the Phoenix Contact AXL F BK and IL BK product families an undocumented password protected FTP access to the root directory exists...

Denial of service

In Phoenix Contact FL COMSERVER UNI in versions 2.40 a invalid Modbus exception response can lead to a temporary denial of service...

CVE-2021-33542 Phoenix Contact: Automation Worx Software Suite affected by Remote Code Execution (RCE) vulnerability

Phoenix Contact Classic Automation Worx Software Suite in Version 1.87 and below is affected by a remote code execution vulnerability. Manipulated PC Worx or Config+ projects could lead to a remote code execution when unallocated memory is freed because of incompletely initialized data. The...

CVE-2021-33542

CVE-2021-33542 affects Phoenix Contact Classic Automation Worx Software Suite

CVE-2021-33541

The CVE-2021-33541 entry affects Phoenix Contact Classic Line Controllers ILC1x0 and ILC1x1 across all versions/variants. The issue is a Denial-of-Service vulnerability caused by authenticationless communication protocols and device access, allowing remote attackers to send crafted IP packets to ...

CVE-2021-33541 Phoenix Contact: ILC1x Industrial controllers affected by Denial-of-Service vulnerability

Phoenix Contact Classic Line Controllers ILC1x0 and ILC1x1 in all versions/variants are affected by a Denial-of-Service vulnerability. The communication protocols and device access do not feature authentication measures. Remote attackers can use specially crafted IP packets to cause a denial of...

CVE-2021-33540

The CVE affects Phoenix Contact AXL F BK and IL BK devices, where an undocumented password-protected FTP access to the root directory exists. The root cause is an insecure/undocumented FTP auth path, enabling access to the device’s root filesystem. The available data indicate a high-severity impa...

CVE-2021-33540 Phoenix Contact: Undocumented FTP acces in certain AXL F BK and IL BK devices

In certain devices of the Phoenix Contact AXL F BK and IL BK product families an undocumented password protected FTP access to the root directory exists...

CVE-2021-21005

CVE-2021-21005 affects Phoenix Contact FL SWITCH SMCS series. A crafted TCP packet with the Urgent-Flag set and Urgent-Pointer at 0 can crash the device’s network stack, requiring a reboot. The provided sources confirm affected product family and the exact trigger, with CVSS indicating HIGH impac...

CVE-2021-21005 Race Condition Vulnerability in Phoenix Contact FL SWITCH SMCS series products

In Phoenix Contact FL SWITCH SMCS series products in multiple versions if an attacker sends a hand-crafted TCP-Packet with the Urgent-Flag set and the Urgent-Pointer set to 0, the network stack will crash. The device needs to be rebooted afterwards...

CVE-2021-21004 Cross-site Scripting Vulnerability in Phoenix Contact FL SWITCH SMCS series products

In Phoenix Contact FL SWITCH SMCS series products in multiple versions an attacker may insert malicious code via LLDP frames into the web-based management which could then be executed by the client...

CVE-2021-21004

CVE-2021-21004 affects Phoenix Contact FL SWITCH SMCS series. An attacker can inject malicious code via LLDP frames into the device’s web-based management, which could be executed by the client. Documented impact includes potential modification or execution of code on the client side, with CVSS d...

CVE-2021-21003 Denial of Service Vulnerability in Phoenix Contact FL SWITCH SMCS series products

In Phoenix Contact FL SWITCH SMCS series products in multiple versions fragmented TCP-Packets may cause a Denial of Service of Web-, SNMP- and ICMP-Echo services. The switching functionality of the device is not affected...

CVE-2021-21003

Phoenix Contact FL SWITCH SMCS series devices are affected by CVE-2021-21003 due to fragmentation of TCP packets. In multiple versions, fragmented TCP-Packets may cause a Denial of Service of Web-, SNMP-, and ICMP-Echo services; switching functionality remains unaffected. The CVE description conf...