Lucene search

CERTVDECVE-2021-34579

HistoryNov 09, 2022 - 5:15 p.m.

CVE-2021-34579

2022-11-0917:15:10

CWE-269

CERTVDE

web.nvd.nist.gov

cve-2021-34579

phoenix contact

fl mguard dm

apache web server

vulnerability

nvd

security issue

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.4

Confidence

High

EPSS

0.002

Percentile

51.4%

JSON

In Phoenix Contact: FL MGUARD DM version 1.12.0 and 1.13.0 access to the Apache web server being installed as part of the FL MGUARD DM on Microsoft Windows does not require login credentials even if configured during installation.Attackers with network access to the Apache web server can download and therefore read mGuard configuration profiles (“ATV profiles”). Such configuration profiles may contain sensitive information, e.g. private keys associated with IPsec VPN connections.

Affected configurations

Nvd

Node

phoenixcontactfl_mguard_dmMatch1.12.0

phoenixcontactfl_mguard_dmMatch1.13.0

VendorProductVersionCPE
phoenixcontactfl_mguard_dm1.12.0cpe:2.3:a:phoenixcontact:fl_mguard_dm:1.12.0:*:*:*:*:*:*:*
phoenixcontactfl_mguard_dm1.13.0cpe:2.3:a:phoenixcontact:fl_mguard_dm:1.13.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
phoenixcontact	fl_mguard_dm	1.12.0	cpe:2.3:a:phoenixcontact:fl_mguard_dm:1.12.0:::::::*
phoenixcontact	fl_mguard_dm	1.13.0	cpe:2.3:a:phoenixcontact:fl_mguard_dm:1.13.0:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "FL MGUARD DM (2981974)",
    "vendor": "PHOENIX CONTACT",
    "versions": [
      {
        "status": "affected",
        "version": "1.12.0"
      },
      {
        "status": "affected",
        "version": "1.13.0"
      }
    ]
  }
]

References

cert.vde.com/en/advisories/VDE-2021-035/

Social References

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.4

Confidence

High

EPSS

0.002

Percentile

51.4%

JSON

Related for CVE-2021-34579