{ "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] }, { "summary": "discovered and reported", "organization": "Fraunhofer- Institut für Optronik, Systemtechnik und Bildauswertung IOSB", "names": [ "Anne Borcherding" ] } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-US", "notes": [ { "category": "summary", "text": "Multiple vulnerabilities have been discovered in the current firmware of the PHOENIX CONTACT FL SWITCH SMCS series switches.", "title": "Summary" }, { "category": "description", "title": "Mitigation", "text": "Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note:\nMeasures to protect network-capable devices with Ethernet connection" } ], "publisher": { "category": "vendor", "contact_details": "psirt@phoenixcontact.com", "name": "Phoenix Contact GmbH & Co. KG", "namespace": "https://phoenixcontact.com/psirt" }, "references": [ { "category": "external", "summary": "PHOENIX CONTACT advisory overview at CERT@VDE", "url": "https://certvde.com/en/advisories/vendor/phoenixcontact/" }, { "category": "self", "summary": "VDE-2021-023: PHOENIX CONTACT: Security Advisory for FL SWITCH SMCS series - HTML", "url": "https://certvde.com/en/advisories/VDE-2021-023" }, { "summary": "VDE-2021-023: PHOENIX CONTACT: Security Advisory for FL SWITCH SMCS series - CSAF", "url": "https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2021/vde-2021-023.json", "category": "self" } ], "title": "PHOENIX CONTACT: Security Advisory for FL SWITCH SMCS series", "tracking": { "aliases": [ "VDE-2021-023" ], "current_release_date": "2025-05-14T12:28:19.000Z", "generator": { "date": "2025-02-10T08:39:41.740Z", "engine": { "name": "Secvisogram", "version": "2.5.18" } }, "id": "VDE-2021-023", "initial_release_date": "2021-06-23T12:17:00.000Z", "revision_history": [ { "date": "2021-05-04T08:17:00.000Z", "number": "1", "summary": "Initial revision." }, { "number": "2", "date": "2025-02-10T09:00:00.000Z", "summary": "Update: Provider data has been corrected" }, { "number": "3", "summary": "Fix: version space, added distribution", "date": "2025-05-14T12:28:19.000Z" } ], "status": "final", "version": "3" } }, "product_tree": { "product_groups": [ { "group_id": "CSAFGID-0001", "summary": "Affected Products.", "product_ids": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015" ] } ], "branches": [ { "category": "vendor", "name": "PHOENIX CONTACT", "branches": [ { "category": "product_family", "name": "Hardware", "branches": [ { "name": "FL NAT SMN 8TX", "category": "product_name", "product": { "product_identification_helper": { "model_numbers": [ "2989365" ] }, "name": "FL NAT SMN 8TX", "product_id": "CSAFPID-11001" } }, { "name": "FL NAT SMN 8TX-M", "category": "product_name", "product": { "product_identification_helper": { "model_numbers": [ "2702443" ] }, "name": "FL NAT SMN 8TX-M", "product_id": "CSAFPID-11002" } }, { "name": "FL SWITCH SMCS 14TX/2FX", "category": "product_name", "product": { "product_identification_helper": { "model_numbers": [ "2700997" ] }, "name": "FL SWITCH SMCS 14TX/2FX", "product_id": "CSAFPID-11003" } }, { "name": "FL SWITCH SMCS 14TX/2FX-SM", "category": "product_name", "product": { "product_identification_helper": { "model_numbers": [ "2701466" ] }, "name": "FL SWITCH SMCS 14TX/2FX-SM", "product_id": "CSAFPID-11004" } }, { "name": "FL SWITCH SMCS 16TX", "category": "product_name", "product": { "name": "FL SWITCH SMCS 16TX", "product_id": "CSAFPID-11005", "product_identification_helper": { "model_numbers": [ "2700996" ] } } }, { "name": "FL SWITCH SMCS 4TX-PN", "product": { "name": "FL SWITCH SMCS 4TX-PN", "product_id": "CSAFPID-11006", "product_identification_helper": { "model_numbers": [ "2989093" ] } }, "category": "product_name" }, { "name": "FL SWITCH SMCS 6GT/2SFP", "category": "product_name", "product": { "name": "FL SWITCH SMCS 6GT/2SFP", "product_id": "CSAFPID-11007", "product_identification_helper": { "model_numbers": [ "2891479" ] } } }, { "name": "FL SWITCH SMCS 6TX/2SFP", "category": "product_name", "product": { "name": "FL SWITCH SMCS 6TX/2SFP", "product_id": "CSAFPID-11008", "product_identification_helper": { "model_numbers": [ "2989323" ] } } }, { "name": "FL SWITCH SMCS 8GT", "category": "product_name", "product": { "name": "FL SWITCH SMCS 8GT", "product_id": "CSAFPID-11009", "product_identification_helper": { "model_numbers": [ "2891123" ] } } }, { "name": "FL SWITCH SMCS 8TX", "category": "product_name", "product": { "name": "FL SWITCH SMCS 8TX", "product_id": "CSAFPID-11010", "product_identification_helper": { "model_numbers": [ "2989226" ] } } }, { "name": "FL SWITCH SMCS 8TX-PN", "category": "product_name", "product": { "name": "FL SWITCH SMCS 8TX-PN", "product_id": "CSAFPID-11011", "product_identification_helper": { "model_numbers": [ "2989103" ] } } }, { "name": "FL SWITCH SMN 6TX/2FX", "category": "product_name", "product": { "name": "FL SWITCH SMN 6TX/2FX", "product_id": "CSAFPID-11012", "product_identification_helper": { "model_numbers": [ "2989543" ] } } }, { "name": "FL SWITCH SMN 6TX/2FX SM", "category": "product_name", "product": { "name": "FL SWITCH SMN 6TX/2FX SM", "product_id": "CSAFPID-11013", "product_identification_helper": { "model_numbers": [ "2989556" ] } } }, { "name": "FL SWITCH SMN 6TX/2POF-PN", "category": "product_name", "product": { "name": "FL SWITCH SMN 6TX/2POF-PN", "product_id": "CSAFPID-11014", "product_identification_helper": { "model_numbers": [ "2700290" ] } } }, { "name": "FL SWITCH SMN 8TX-PN", "category": "product_name", "product": { "name": "FL SWITCH SMN 8TX-PN", "product_id": "CSAFPID-11015", "product_identification_helper": { "model_numbers": [ "2989501" ] } } } ] }, { "name": "Firmware", "category": "product_family", "branches": [ { "name": "<=4.63", "category": "product_version_range", "product": { "name": "Firmware <=4.63", "product_id": "CSAFPID-21001" } }, { "name": "<=4.70", "category": "product_version_range", "product": { "name": "Firmware <=4.70", "product_id": "CSAFPID-21002" } } ] } ] } ], "relationships": [ { "relates_to_product_reference": "CSAFPID-11001", "category": "installed_on", "product_reference": "CSAFPID-21001", "full_product_name": { "name": "Firmware <=4.63 installed on FL NAT SMN 8TX", "product_id": "CSAFPID-31001" } }, { "relates_to_product_reference": "CSAFPID-11002", "product_reference": "CSAFPID-21001", "category": "installed_on", "full_product_name": { "name": "Firmware <=4.63 installed on FL NAT SMN 8TX-M", "product_id": "CSAFPID-31002" } }, { "relates_to_product_reference": "CSAFPID-11003", "product_reference": "CSAFPID-21002", "category": "installed_on", "full_product_name": { "name": "Firmware <=4.70 installed on FL SWITCH SMCS 14TX/2FX", "product_id": "CSAFPID-31003" } }, { "relates_to_product_reference": "CSAFPID-11004", "product_reference": "CSAFPID-21001", "category": "installed_on", "full_product_name": { "name": "Firmware <= 2021.0 LTS installed on AXC F 3152", "product_id": "CSAFPID-31004" } }, { "relates_to_product_reference": "CSAFPID-11004", "product_reference": "CSAFPID-21002", "category": "installed_on", "full_product_name": { "name": "Firmware <=4.70 installed on FL SWITCH SMCS 14TX/2FX-SM", "product_id": "CSAFPID-31005" } }, { "relates_to_product_reference": "CSAFPID-11005", "product_reference": "CSAFPID-21002", "category": "installed_on", "full_product_name": { "name": "Firmware <=4.70 installed on FL SWITCH SMCS 16TX", "product_id": "CSAFPID-31006" } }, { "relates_to_product_reference": "CSAFPID-11006", "product_reference": "CSAFPID-21002", "category": "installed_on", "full_product_name": { "name": "Firmware <= V1.0.11 installed on CHARX control modular 3100", "product_id": "CSAFPID-31007" } }, { "relates_to_product_reference": "CSAFPID-11007", "product_reference": "CSAFPID-21002", "category": "installed_on", "full_product_name": { "name": "Firmware <=4.70 installed on FL SWITCH SMCS 6GT/2SFP", "product_id": "CSAFPID-31008" } }, { "relates_to_product_reference": "CSAFPID-11008", "product_reference": "CSAFPID-21002", "category": "installed_on", "full_product_name": { "name": "Firmware <=4.70 installed on FL SWITCH SMCS 6TX/2SFP", "product_id": "CSAFPID-31009" } }, { "relates_to_product_reference": "CSAFPID-11009", "product_reference": "CSAFPID-21002", "category": "installed_on", "full_product_name": { "name": "Firmware <=4.70 installed on FL SWITCH SMCS 8GT", "product_id": "CSAFPID-31010" } }, { "relates_to_product_reference": "CSAFPID-11010", "product_reference": "CSAFPID-21002", "category": "installed_on", "full_product_name": { "name": "Firmware <=4.70 installed on FL SWITCH SMCS 8TX", "product_id": "CSAFPID-31011" } }, { "relates_to_product_reference": "CSAFPID-11011", "product_reference": "CSAFPID-21002", "category": "installed_on", "full_product_name": { "name": "Firmware <=4.70 installed on FL SWITCH SMCS 8TX-PN", "product_id": "CSAFPID-31012" } }, { "relates_to_product_reference": "CSAFPID-11013", "product_reference": "CSAFPID-21002", "category": "installed_on", "full_product_name": { "name": "Firmware <=4.70 installed on FL SWITCH SMN 6TX/2FX SM", "product_id": "CSAFPID-31013" } }, { "relates_to_product_reference": "CSAFPID-11014", "product_reference": "CSAFPID-21002", "category": "installed_on", "full_product_name": { "name": "Firmware <=4.70 installed on FL SWITCH SMN 6TX/2POF-PN", "product_id": "CSAFPID-31014" } }, { "relates_to_product_reference": "CSAFPID-11015", "product_reference": "CSAFPID-21002", "category": "installed_on", "full_product_name": { "name": "Firmware <=4.70 installed on FL SWITCH SMN 8TX-PN", "product_id": "CSAFPID-31015" } } ] }, "vulnerabilities": [ { "cve": "CVE-2021-21005", "title": "CVE-2021-21005", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')" }, "notes": [ { "title": "Vulnerability Description", "category": "description", "text": "In Phoenix Contact FL SWITCH SMCS series products in multiple versions if an attacker sends a hand-crafted TCP-Packet with the Urgent-Flag set and the Urgent-Pointer set to 0, the network stack will crash. The device needs to be rebooted afterwards." } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015" ] }, "remediations": [ { "details": "Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note:\nMeasures to protect network-capable devices with Ethernet connection", "category": "mitigation", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "temporalScore": 7.5, "temporalSeverity": "HIGH", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015" ] } ] }, { "cve": "CVE-2021-21004", "title": "CVE-2021-21004", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "notes": [ { "title": "Vulnerability Description", "category": "description", "text": "In Phoenix Contact FL SWITCH SMCS series products in multiple versions an attacker may insert malicious code via LLDP frames into the web-based management which could then be executed by the client." } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015" ] }, "remediations": [ { "details": "Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note:\nMeasures to protect network-capable devices with Ethernet connection", "category": "mitigation", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "temporalScore": 6.1, "temporalSeverity": "MEDIUM", "environmentalScore": 6.1, "environmentalSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015" ] } ] }, { "cve": "CVE-2021-21003", "title": "CVE-2021-21003", "cwe": { "id": "CWE-404", "name": "Improper Resource Shutdown or Release" }, "notes": [ { "title": "Vulnerability Description", "category": "description", "text": "In Phoenix Contact FL SWITCH SMCS series products in multiple versions fragmented TCP-Packets may cause a Denial of Service of Web-, SNMP- and ICMP-Echo services. The switching functionality of the device is not affected." } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015" ] }, "remediations": [ { "details": "Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note:\nMeasures to protect network-capable devices with Ethernet connection", "category": "mitigation", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "baseScore": 5.3, "baseSeverity": "MEDIUM", "temporalScore": 5.3, "temporalSeverity": "MEDIUM", "environmentalScore": 5.3, "environmentalSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015" ] } ] } ] }