{"containers": {"cna": {"affected": [{"product": "FL SWITCH", "vendor": "Phoenix Contact", "versions": [{"lessThanOrEqual": "4.70", "status": "affected", "version": "SMCS 16TX (2700996)", "versionType": "custom"}, {"lessThanOrEqual": "4.70", "status": "affected", "version": "SMCS 14TX/2FX (2700997)", "versionType": "custom"}, {"lessThanOrEqual": "4.70", "status": "affected", "version": "SMCS 14TX/2FX-SM (2701466)", "versionType": "custom"}, {"lessThanOrEqual": "4.70", "status": "affected", "version": "SMCS 8GT (2891123)", "versionType": "custom"}, {"lessThanOrEqual": "4.70", "status": "affected", "version": "SMCS 6GT/2SFP (2891479)", "versionType": "custom"}, {"lessThanOrEqual": "4.70", "status": "affected", "version": "SMCS 8TX-PN (2989103)", "versionType": "custom"}, {"lessThanOrEqual": "4.70", "status": "affected", "version": "SMCS 4TX-PN (2989093)", "versionType": "custom"}, {"lessThanOrEqual": "4.70", "status": "affected", "version": "SMCS 8TX (2989226)", "versionType": "custom"}, {"lessThanOrEqual": "4.70", "status": "affected", "version": "SMCS 6TX/2SFP (2989323)", "versionType": "custom"}, {"lessThanOrEqual": "4.70", "status": "affected", "version": "SMN 6TX/2POF-PN (2700290)", "versionType": "custom"}, {"lessThanOrEqual": "4.70", "status": "affected", "version": "SMN 8TX-PN (2989501)", "versionType": "custom"}, {"lessThanOrEqual": "4.70", "status": "affected", "version": "SMN 6TX/2FX (2989543)", "versionType": "custom"}, {"lessThanOrEqual": "4.70", "status": "affected", "version": "SMN 6TX/2FX SM (2989556)", "versionType": "custom"}]}, {"product": "FL NAT", "vendor": "Phoenix Contact", "versions": [{"lessThanOrEqual": "4.63", "status": "affected", "version": "SMN 8TX (2989365)", "versionType": "custom"}, {"lessThanOrEqual": "4.63", "status": "affected", "version": "SMN 8TX-M (2702443)", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "This vulnerability has been discovered and reported by Anne Borcherding, Fraunhofer- Institut f\u00fcr Optronik, Systemtechnik und Bildauswertung IOSB. PHOENIX CONTACT thanks CERT@VDE for the coordination and support with this publication."}], "datePublic": "2021-06-23T00:00:00", "descriptions": [{"lang": "en", "value": "In Phoenix Contact FL SWITCH SMCS series products in multiple versions an attacker may insert malicious code via LLDP frames into the web-based management which could then be executed by the client."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Cross-site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-06-25T18:25:52", "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://cert.vde.com/en-us/advisories/vde-2021-023"}], "source": {"advisory": "VDE-2021-023", "defect": ["VDE-2021-023"], "discovery": "EXTERNAL"}, "title": "Cross-site Scripting Vulnerability in Phoenix Contact FL SWITCH SMCS series products", "workarounds": [{"lang": "en", "value": "Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to the Phoenix Contact application note:\nMeasures to protect network-capable devices with Ethernet connection https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf"}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "info@cert.vde.com", "DATE_PUBLIC": "2021-06-23T10:00:00.000Z", "ID": "CVE-2021-21004", "STATE": "PUBLIC", "TITLE": "Cross-site Scripting Vulnerability in Phoenix Contact FL SWITCH SMCS series products"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "FL SWITCH", "version": {"version_data": [{"version_affected": "<=", "version_name": "SMCS 16TX (2700996)", "version_value": "4.70"}, {"version_affected": "<=", "version_name": "SMCS 14TX/2FX (2700997)", "version_value": "4.70"}, {"version_affected": "<=", "version_name": "SMCS 14TX/2FX-SM (2701466)", "version_value": "4.70"}, {"version_affected": "<=", "version_name": "SMCS 8GT (2891123)", "version_value": "4.70"}, {"version_affected": "<=", "version_name": "SMCS 6GT/2SFP (2891479)", "version_value": "4.70"}, {"version_affected": "<=", "version_name": "SMCS 8TX-PN (2989103)", "version_value": "4.70"}, {"version_affected": "<=", "version_name": "SMCS 4TX-PN (2989093)", "version_value": "4.70"}, {"version_affected": "<=", "version_name": "SMCS 8TX (2989226)", "version_value": "4.70"}, {"version_affected": "<=", "version_name": "SMCS 6TX/2SFP (2989323)", "version_value": "4.70"}, {"version_affected": "<=", "version_name": "SMN 6TX/2POF-PN (2700290)", "version_value": "4.70"}, {"version_affected": "<=", "version_name": "SMN 8TX-PN (2989501)", "version_value": "4.70"}, {"version_affected": "<=", "version_name": "SMN 6TX/2FX (2989543)", "version_value": "4.70"}, {"version_affected": "<=", "version_name": "SMN 6TX/2FX SM (2989556)", "version_value": "4.70"}]}}, {"product_name": "FL NAT", "version": {"version_data": [{"version_affected": "<=", "version_name": "SMN 8TX (2989365)", "version_value": "4.63"}, {"version_affected": "<=", "version_name": "SMN 8TX-M (2702443)", "version_value": "4.63"}]}}]}, "vendor_name": "Phoenix Contact"}]}}, "credit": [{"lang": "eng", "value": "This vulnerability has been discovered and reported by Anne Borcherding, Fraunhofer- Institut f\u00fcr Optronik, Systemtechnik und Bildauswertung IOSB. PHOENIX CONTACT thanks CERT@VDE for the coordination and support with this publication."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In Phoenix Contact FL SWITCH SMCS series products in multiple versions an attacker may insert malicious code via LLDP frames into the web-based management which could then be executed by the client."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79 Cross-site Scripting (XSS)"}]}]}, "references": {"reference_data": [{"name": "https://cert.vde.com/en-us/advisories/vde-2021-023", "refsource": "CONFIRM", "url": "https://cert.vde.com/en-us/advisories/vde-2021-023"}]}, "source": {"advisory": "VDE-2021-023", "defect": ["VDE-2021-023"], "discovery": "EXTERNAL"}, "work_around": [{"lang": "en", "value": "Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to the Phoenix Contact application note:\nMeasures to protect network-capable devices with Ethernet connection https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf"}]}}}, "cveMetadata": {"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "assignerShortName": "CERTVDE", "cveId": "CVE-2021-21004", "datePublished": "2021-06-23T00:00:00", "dateReserved": "2020-12-17T00:00:00", "dateUpdated": "2021-06-25T18:25:52", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:fl_switch_smcs_16tx_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "4CDDEB10-788C-415A-9755-64C162201992", "versionEndIncluding": "4.70", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:fl_switch_smcs_16tx:-:*:*:*:*:*:*:*", "matchCriteriaId": "51C916CC-15CA-4F7F-83BC-4DB2C29A993C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:fl_switch_smcs_14tx\\/2fx_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "CA89CC68-7F88-4ACB-B78F-1F8CDB4E66E2", "versionEndIncluding": "4.70", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:fl_switch_smcs_14tx\\/2fx:-:*:*:*:*:*:*:*", "matchCriteriaId": "F857640B-80AC-4474-8315-60703D28EB84", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:fl_switch_smcs_14tx\\/2fx-sm_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "334E6016-A7D5-44E4-A118-2133B6CA406F", "versionEndIncluding": "4.70", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:fl_switch_smcs_14tx\\/2fx-sm:-:*:*:*:*:*:*:*", "matchCriteriaId": "25EEA47E-625E-43AB-8D71-F068675A9E88", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:fl_switch_smcs_8gt_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "F54B5E21-F02B-4AE6-862F-3E419B9C765A", "versionEndIncluding": "4.70", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:fl_switch_smcs_8gt:-:*:*:*:*:*:*:*", "matchCriteriaId": "9E319EE0-0BE2-4C24-A426-26903F4D9924", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:fl_switch_smcs_6gt\\/2sfp_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "C3D06010-FACB-44C2-9737-88FAA6693DA8", "versionEndIncluding": "4.70", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:fl_switch_smcs_6gt\\/2sfp:-:*:*:*:*:*:*:*", "matchCriteriaId": "2E1196AA-CD50-4799-86A2-DED0D56CB53A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:fl_switch_smcs_8tx-pn_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "3B549DAB-C568-4E08-89F9-971B1DFBF008", "versionEndIncluding": "4.70", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:fl_switch_smcs_8tx-pn:-:*:*:*:*:*:*:*", "matchCriteriaId": "D38E31A8-E0A9-4BE1-ADD9-5660E5392B9E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:fl_switch_smcs_4tx-pn_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "16769058-19DC-4851-9AC9-2BB1C205E32F", "versionEndIncluding": "4.70", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:fl_switch_smcs_4tx-pn:-:*:*:*:*:*:*:*", "matchCriteriaId": "8A1C4B35-EE9B-4EAC-8A9B-E8188D3EB4EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:fl_switch_smcs_8tx_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "A86969BA-3F9C-424A-A003-95F537B63172", "versionEndIncluding": "4.70", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:fl_switch_smcs_8tx:-:*:*:*:*:*:*:*", "matchCriteriaId": "9EBF53F7-0B39-4E8A-B1F8-C99CAA062DF5", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:fl_switch_smcs_6tx\\/2sfp_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "A5AF58FC-0E28-467D-8167-C3DB6BE47C3E", "versionEndIncluding": "4.70", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:fl_switch_smcs_6tx\\/2sfp:-:*:*:*:*:*:*:*", "matchCriteriaId": "C98B0801-5CD9-4276-8E39-65C2DD5923BF", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:fl_switch_smn_6tx\\/2pof-pn_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "4AE6705F-13EF-4685-9E62-D0E94C863A75", "versionEndIncluding": "4.70", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:fl_switch_smn_6tx\\/2pof-pn:-:*:*:*:*:*:*:*", "matchCriteriaId": "49EFD53E-6260-4B04-B866-8C7757FFE339", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:fl_switch_smn_8tx-pn_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "7E7F051D-0EA6-442F-9470-D916971C45C0", "versionEndIncluding": "4.70", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:fl_switch_smn_8tx-pn:-:*:*:*:*:*:*:*", "matchCriteriaId": "E0289C54-7F31-4777-AD97-3D5CEF5E8E69", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:fl_switch_smn_6tx\\/2fx_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "990CECCE-C438-4BDC-BCD9-D0BBA7E4C6F8", "versionEndIncluding": "4.70", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:fl_switch_smn_6tx\\/2fx:-:*:*:*:*:*:*:*", "matchCriteriaId": "EC332621-9FEC-40E0-AE7A-76F13F7FCE57", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:fl_switch_smn_6tx\\/2fx_sm_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "F11861A4-B692-4781-B4CA-B48BE7ECD212", "versionEndIncluding": "4.70", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:fl_switch_smn_6tx\\/2fx_sm:-:*:*:*:*:*:*:*", "matchCriteriaId": "01FD1C84-FFD7-48A1-8EC2-7D6AC4896266", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:fl_nat_smn_8tx_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "0EFA2320-2E1C-49FC-BF70-12BE51770537", "versionEndIncluding": "4.63", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:fl_nat_smn_8tx:-:*:*:*:*:*:*:*", "matchCriteriaId": "427C31A9-C301-4B24-808D-B46E054557D6", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:fl_nat_smn_8tx-m_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "CC296B35-23D1-4AE8-AC95-E636A0523C66", "versionEndIncluding": "4.63", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:fl_nat_smn_8tx-m:-:*:*:*:*:*:*:*", "matchCriteriaId": "E8E560F4-EB19-4A41-A3CC-F88F7BA3BD65", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "In Phoenix Contact FL SWITCH SMCS series products in multiple versions an attacker may insert malicious code via LLDP frames into the web-based management which could then be executed by the client."}, {"lang": "es", "value": "En los productos de la serie Phoenix Contact FL SWITCH SMCS en m\u00faltiples versiones, un atacante puede insertar c\u00f3digo malicioso por medio de tramas LLDP en la administraci\u00f3n basada en la web, que luego podr\u00eda ser ejecutado por el cliente"}], "id": "CVE-2021-21004", "lastModified": "2021-07-02T00:00:42.913", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 4.7, "source": "info@cert.vde.com", "type": "Secondary"}]}, "published": "2021-06-25T19:15:08.730", "references": [{"source": "info@cert.vde.com", "tags": ["Not Applicable", "Third Party Advisory"], "url": "https://cert.vde.com/en-us/advisories/vde-2021-023"}], "sourceIdentifier": "info@cert.vde.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "info@cert.vde.com", "type": "Secondary"}]}

{}