CVE-2021-21004
High
Description
In Phoenix Contact FL SWITCH SMCS series products in multiple versions an attacker may insert malicious code via LLDP frames into the web-based management which could then be executed by the client.
SeverityHigh
CVSS7.4
Exploit probability—
ProductPhoenixcontact Fl Switch Smcs 16tx Firmware
PublishedJun 25, 2021
First seenJun 25, 2021
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phoenixcontact fl_switch_smcs_16tx_firmware | v ≤ 4.70 | — |
| phoenixcontact fl_switch_smcs_14tx\/2fx_firmware | v ≤ 4.70 | — |
| phoenixcontact fl_switch_smcs_14tx\/2fx-sm_firmware | v ≤ 4.70 | — |
| phoenixcontact fl_switch_smcs_8gt_firmware | v ≤ 4.70 | — |
| phoenixcontact fl_switch_smcs_6gt\/2sfp_firmware | v ≤ 4.70 | — |
| phoenixcontact fl_switch_smcs_8tx-pn_firmware | v ≤ 4.70 | — |
| phoenixcontact fl_switch_smcs_4tx-pn_firmware | v ≤ 4.70 | — |
| phoenixcontact fl_switch_smcs_8tx_firmware | v ≤ 4.70 | — |
| phoenixcontact fl_switch_smcs_6tx\/2sfp_firmware | v ≤ 4.70 | — |
| phoenixcontact fl_switch_smn_6tx\/2pof-pn_firmware | v ≤ 4.70 | — |
| phoenixcontact fl_switch_smn_8tx-pn_firmware | v ≤ 4.70 | — |
| phoenixcontact fl_switch_smn_6tx\/2fx_firmware | v ≤ 4.70 | — |
| phoenixcontact fl_switch_smn_6tx\/2fx_sm_firmware | v ≤ 4.70 | — |
| phoenixcontact fl_nat_smn_8tx_firmware | v ≤ 4.63 | — |
| phoenixcontact fl_nat_smn_8tx-m_firmware | v ≤ 4.63 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.