Vulnerability · Published Aug 31, 2021 · Assigned by CERTVDE
CVE-2021-34560A vulnerability in WirelessHART-Gateway <= 3.0.9 could lead to information exposure of sensitive information
Medium 5.5
In plain English
A medium-severity security flaw in WHA-GW-F2D2-0-AS- Z2-ETH from Phoenix Contact. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.2%top 89.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.9 a form contains a password field with autocomplete enabled. The stored credentials can be captured by an attacker who gains control over the user's computer. Therefore the user must have logged in at least once.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Phoenix Contact | WHA-GW-F2D2-0-AS- Z2-ETH | 3.0.9 – through 3.0.9 |
| Phoenix Contact | WHA-GW-F2D2-0-AS- Z2-ETH.EIP | 3.0.9 – through 3.0.9 |
Weakness: CWE-522 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
References
- https://cert.vde.com/en-us/advisories/vde-2021-027 x_refsource_CONFIRM