{ "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] }, { "summary": "discovered and reported", "organization": "Waertsilae PSIRT", "names": [ "Petri Tuomio" ] } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-US", "notes": [ { "category": "summary", "text": "When the communication partner sends an invalid Modbus exception response to the FL COMSERVER UNI as a query, the Modbus communication stops, and the device will be unresponsive for some minutes before the functionality is fully restored (CWE-772).", "title": "Summary" }, { "category": "description", "title": "Remediation", "text": "PHOENIX CONTACT recommends affected users to upgrade to the latest firmware version which is available for download.\n| **Product Number** | **Product Name** | **Firmware Version** |\n|--------------------|------------------------------------|-----------------------------|\n| 2313452 | FL COMSERVER UNI 232/422/485 | 2.41 |\n| 2904817 | FL COMSERVER UNI 232/422/485-T | 2.41 |\n" }, { "category": "description", "title": "Impact", "text": "An attacker may use this vulnerability to execute a Denial of Service (DoS) attack." } ], "publisher": { "category": "vendor", "contact_details": "psirt@phoenixcontact.com", "name": "Phoenix Contact GmbH & Co. KG", "namespace": "https://phoenixcontact.com/psirt" }, "references": [ { "category": "external", "summary": "PHOENIX CONTACT advisory overview at CERT@VDE", "url": "https://certvde.com/en/advisories/vendor/phoenixcontact/" }, { "category": "self", "summary": "VDE-2021-022: PHOENIX CONTACT: Security Advisory for FL COMSERVER UNI - HTML", "url": "https://certvde.com/en/advisories/VDE-2021-022" }, { "summary": "VDE-2021-022: PHOENIX CONTACT: Security Advisory for FL COMSERVER UNI - CSAF", "url": "https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2021/vde-2021-022.json", "category": "self" } ], "title": "PHOENIX CONTACT: Security Advisory for FL COMSERVER UNI", "tracking": { "aliases": [ "VDE-2021-022" ], "current_release_date": "2025-05-14T12:28:19.000Z", "generator": { "date": "2025-02-10T08:35:43.259Z", "engine": { "name": "Secvisogram", "version": "2.5.18" } }, "id": "VDE-2021-022", "initial_release_date": "2021-06-23T12:16:00.000Z", "revision_history": [ { "date": "2021-06-23T12:16:00.000Z", "number": "1", "summary": "Initial revision." }, { "number": "2", "date": "2025-02-10T09:00:00.000Z", "summary": "Update: Provider data has been corrected" }, { "number": "3", "summary": "Fix: version space, firmware category, added distribution", "date": "2025-05-14T12:28:19.000Z" } ], "status": "final", "version": "3" } }, "product_tree": { "product_groups": [ { "group_id": "CSAFGID-0001", "summary": "Affected Products.", "product_ids": [ "CSAFPID-31001", "CSAFPID-31002" ] }, { "group_id": "CSAFGID-0002", "summary": "fixed product.", "product_ids": [ "CSAFPID-32001", "CSAFPID-32002" ] } ], "branches": [ { "category": "vendor", "name": "PHOENIX CONTACT", "branches": [ { "category": "product_family", "name": "Hardware", "branches": [ { "name": "FL COMSERVER UNI 232/422/485", "category": "product_name", "product": { "product_identification_helper": { "model_numbers": [ "2313452" ] }, "name": "FL COMSERVER UNI 232/422/485", "product_id": "CSAFPID-11001" } }, { "name": "FL COMSERVER UNI 232/422/485-T", "category": "product_name", "product": { "product_identification_helper": { "model_numbers": [ "2904817" ] }, "name": "FL COMSERVER UNI 232/422/485-T", "product_id": "CSAFPID-11002" } } ] }, { "name": "Firmware", "category": "product_family", "branches": [ { "name": "<2.40", "category": "product_version_range", "product": { "name": " Firmware <2.40", "product_id": "CSAFPID-21001" } }, { "name": "2.41", "category": "product_version", "product": { "name": "Firmware 2.41", "product_id": "CSAFPID-22001" } } ] } ] } ], "relationships": [ { "relates_to_product_reference": "CSAFPID-11001", "category": "installed_on", "product_reference": "CSAFPID-21001", "full_product_name": { "name": " Firmware <2.40 installed on FL COMSERVER UNI 232/422/485", "product_id": "CSAFPID-31001" } }, { "relates_to_product_reference": "CSAFPID-11002", "product_reference": "CSAFPID-21001", "category": "installed_on", "full_product_name": { "name": " Firmware <2.40 installed on FL COMSERVER UNI 232/422/485-T", "product_id": "CSAFPID-31002" } }, { "relates_to_product_reference": "CSAFPID-11001", "product_reference": "CSAFPID-22001", "category": "installed_on", "full_product_name": { "name": "Firmware 2.41 installed on FL COMSERVER UNI 232/422/485", "product_id": "CSAFPID-32001" } }, { "relates_to_product_reference": "CSAFPID-11002", "product_reference": "CSAFPID-22001", "category": "installed_on", "full_product_name": { "name": "Firmware 2.41 installed on FL COMSERVER UNI 232/422/485-T", "product_id": "CSAFPID-32002" } } ] }, "vulnerabilities": [ { "cve": "CVE-2021-21002", "title": "CVE-2021-21002", "cwe": { "id": "CWE-772", "name": "Missing Release of Resource after Effective Lifetime" }, "notes": [ { "title": "Vulnerability Description", "category": "description", "text": "In Phoenix Contact FL COMSERVER UNI in versions <2.40 a invalid Modbus exception response can lead to a temporary denial of service." } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002" ], "fixed": [ "CSAFPID-32001", "CSAFPID-32002" ] }, "remediations": [ { "details": "Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note:\nMeasures to protect network-capable devices with Ethernet connection", "category": "mitigation", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "temporalScore": 7.5, "temporalSeverity": "HIGH", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH" }, "products": [ "CSAFPID-31001", "CSAFPID-31002" ] } ] } ] }