CVE-2021-33540
High
Description
In certain devices of the Phoenix Contact AXL F BK and IL BK product families an undocumented password protected FTP access to the root directory exists.
SeverityHigh
CVSS7.3
Exploit probability—
ProductPhoenixcontact Axl F Bk Pn Tps Xc Firmware
PublishedJun 25, 2021
First seenJun 25, 2021
Weakness typeCWE-798Hard-coded credentials
How to fix
Update
- phoenixcontact axl_f_bk_pn_tps_xc_firmware1.30 or later
- phoenixcontact axl_f_bk_pn_tps_firmware1.30 or later
- phoenixcontact axl_f_bk_eip_firmware1.30 or later
- phoenixcontact axl_f_bk_eip_ef_firmware1.30 or later
- phoenixcontact axl_f_bk_eth_firmware1.30 or later
- phoenixcontact axl_f_bk_eth_xc_firmware1.30 or later
- phoenixcontact axl_f_bk_s35_firmware1.40 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phoenixcontact axl_f_bk_pn_tps_xc_firmware | v < 1.30 | 1.30 |
| phoenixcontact axl_f_bk_pn_tps_firmware | v < 1.30 | 1.30 |
| phoenixcontact axl_f_bk_eip_firmware | v < 1.30 | 1.30 |
| phoenixcontact axl_f_bk_eip_ef_firmware | v < 1.30 | 1.30 |
| phoenixcontact axl_f_bk_eth_firmware | v < 1.30 | 1.30 |
| phoenixcontact axl_f_bk_eth_xc_firmware | v < 1.30 | 1.30 |
| phoenixcontact axl_f_bk_s35_firmware | v < 1.40 | 1.40 |
| phoenixcontact axl_f_bk_pn_firmware | No range specified | — |
| phoenixcontact axl_f_bk_pn_xc_firmware | No range specified | — |
| phoenixcontact axl_f_bk_eth_net2_firmware | No range specified | — |
| phoenixcontact axl_f_bk_sas_firmware | No range specified | — |
| phoenixcontact il_pn_bk-pac_firmware | No range specified | — |
| phoenixcontact il_pn_bk_di8_do4_2tx-pac_firmware | No range specified | — |
| phoenixcontact il_pn_bk_di8_do4_2scrj-pac_firmware | No range specified | — |
| phoenixcontact il_eth_bk_di8_do4_2tx-xc-pac_firmware | No range specified | — |
| phoenixcontact il_eth_bk_di8_do4_2tx-pac_firmware | No range specified | — |
| phoenixcontact il_eip_bk_di8_do4_2tx-pac_firmware | No range specified | — |
| phoenixcontact il_s3_bk_di8_do4_2tx-pac_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.