Vulnerability · Published Jun 25, 2021 · Assigned by CERTVDE
CVE-2021-33540Phoenix Contact: Undocumented FTP acces in certain AXL F BK and IL BK devices
High 7.3
In plain English
A high-severity hard-coded credentials in AXL F BK from Phoenix Contact. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.7%top 45.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In certain devices of the Phoenix Contact AXL F BK and IL BK product families an undocumented password protected FTP access to the root directory exists.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Phoenix Contact | AXL F BK | AXL F PN TPS XC (1068857) – before 1.30AXL F EIP EF (2702782) – before 1.30 |
| Phoenix Contact | AXL F BK | AXL F PN TPS (2403869) – before 1.30 |
| Phoenix Contact | AXL F BK | AXL F EIP (2688394) – before 1.30AXL F ETH (2688459) – before 1.30AXL F ETH XC (2701949) – before 1.30AXL F S3 (2701686) – before 1.40 |
| Phoenix Contact | AXL F BK | AXL F PN (2701815) all revisionsAXL F PN XC (2701222) all revisionsAXL F ETH NET2 (2702177) all revisionsAXL F SAS (2701457) all revisions |
| Phoenix Contact | IL | IL PN BK-PAC (2403696) all revisionsIL PN BK DI8 DO4 2TX-PAC (2703994) all revisionsIL PN BK DI8 DO4 2SCRJ-PAC (2878379) all revisionsIL ETH BK DI8 DO4 2TX-XC-PAC (2701388) all revisionsIL ETH BK DI8 DO4 2TX-PAC (2703981) all revisionsIL EIP BK DI8 DO4 2TX-PAC (2897758) all revisionsIL S3 BK DI8 DO4 2TX-PAC (2692380) all revisions |
Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
References
- https://cert.vde.com/en-us/advisories/vde-2021-021 x_refsource_CONFIRM