CVE-2021-33540

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-33540
In certain devices of the Phoenix Contact AXL F BK and IL BK product families an undocumented password protected FTP access to the root directory exists.

7.3 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://cert.vde.com/en-us/advisories/vde-2021-021 Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:phoenixcontact:axl_f_bk_pn_tps_xc_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:axl_f_bk_pn_tps_xc:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:phoenixcontact:axl_f_bk_pn_tps_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:axl_f_bk_pn_tps:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:phoenixcontact:axl_f_bk_eip_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:axl_f_bk_eip:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:phoenixcontact:axl_f_bk_eip_ef_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:axl_f_bk_eip_ef:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:phoenixcontact:axl_f_bk_eth_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:axl_f_bk_eth:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:phoenixcontact:axl_f_bk_eth_xc_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:axl_f_bk_eth_xc:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:phoenixcontact:axl_f_bk_s35_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:axl_f_bk_s35:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:phoenixcontact:axl_f_bk_pn_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:axl_f_bk_pn:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:phoenixcontact:axl_f_bk_pn_xc_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:axl_f_bk_pn_xc:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:phoenixcontact:axl_f_bk_eth_net2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:axl_f_bk_eth_net2:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:phoenixcontact:axl_f_bk_sas_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:axl_f_bk_sas:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:phoenixcontact:il_pn_bk-pac_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:il_pn_bk-pac:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:phoenixcontact:il_pn_bk_di8_do4_2tx-pac_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:il_pn_bk_di8_do4_2tx-pac:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
cpe:2.3:o:phoenixcontact:il_pn_bk_di8_do4_2scrj-pac_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:il_pn_bk_di8_do4_2scrj-pac:-:*:*:*:*:*:*:*

Configuration 15 (hide)

AND
cpe:2.3:o:phoenixcontact:il_eth_bk_di8_do4_2tx-xc-pac_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:il_eth_bk_di8_do4_2tx-xc-pac:-:*:*:*:*:*:*:*

Configuration 16 (hide)

AND
cpe:2.3:o:phoenixcontact:il_eth_bk_di8_do4_2tx-pac_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:il_eth_bk_di8_do4_2tx-pac:-:*:*:*:*:*:*:*

Configuration 17 (hide)

AND
cpe:2.3:o:phoenixcontact:il_eip_bk_di8_do4_2tx-pac_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:il_eip_bk_di8_do4_2tx-pac:-:*:*:*:*:*:*:*

Configuration 18 (hide)

AND
cpe:2.3:o:phoenixcontact:il_s3_bk_di8_do4_2tx-pac_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:il_s3_bk_di8_do4_2tx-pac:-:*:*:*:*:*:*:*
History

02 Jul 2021, 00:05

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : 7.5
v3 : 7.3
References (CONFIRM) https://cert.vde.com/en-us/advisories/vde-2021-021 - (CONFIRM) https://cert.vde.com/en-us/advisories/vde-2021-021 - Third Party Advisory
CWE CWE-798
CPE cpe:2.3:h:phoenixcontact:axl_f_bk_pn:-:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:axl_f_bk_s35:-:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:il_pn_bk_di8_do4_2scrj-pac_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:il_eth_bk_di8_do4_2tx-pac:-:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:axl_f_bk_eth_net2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:il_pn_bk_di8_do4_2tx-pac_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:axl_f_bk_eth_xc:-:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:axl_f_bk_pn_tps_xc:-:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:axl_f_bk_pn_tps:-:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:axl_f_bk_s35_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:axl_f_bk_eip_ef:-:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:axl_f_bk_eth_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:axl_f_bk_eth_net2:-:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:axl_f_bk_sas_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:il_pn_bk-pac_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:il_s3_bk_di8_do4_2tx-pac:-:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:axl_f_bk_eip_ef_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:il_eip_bk_di8_do4_2tx-pac:-:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:il_eth_bk_di8_do4_2tx-pac_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:axl_f_bk_pn_tps_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:axl_f_bk_sas:-:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:axl_f_bk_eth_xc_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:il_eip_bk_di8_do4_2tx-pac_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:axl_f_bk_eip:-:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:il_eth_bk_di8_do4_2tx-xc-pac:-:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:axl_f_bk_eip_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:il_s3_bk_di8_do4_2tx-pac_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:il_eth_bk_di8_do4_2tx-xc-pac_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:il_pn_bk-pac:-:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:il_pn_bk_di8_do4_2scrj-pac:-:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:axl_f_bk_eth:-:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:axl_f_bk_pn_xc_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:il_pn_bk_di8_do4_2tx-pac:-:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:axl_f_bk_pn_tps_xc_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:phoenixcontact:axl_f_bk_pn_xc:-:*:*:*:*:*:*:*
cpe:2.3:o:phoenixcontact:axl_f_bk_pn_firmware:*:*:*:*:*:*:*:*

25 Jun 2021, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2021-06-25 19:15

Updated : 2024-02-04 21:47

NVD link : CVE-2021-33540

Mitre link : CVE-2021-33540

CVE.ORG link : CVE-2021-33540

JSON object : View

Products Affected

phoenixcontact

  • axl_f_bk_eth_net2_firmware
  • axl_f_bk_eth_firmware
  • axl_f_bk_pn_tps_firmware
  • axl_f_bk_eth_net2
  • axl_f_bk_eip_firmware
  • axl_f_bk_eip_ef_firmware
  • il_eth_bk_di8_do4_2tx-xc-pac_firmware
  • il_s3_bk_di8_do4_2tx-pac_firmware
  • il_pn_bk_di8_do4_2scrj-pac
  • axl_f_bk_eth_xc
  • il_pn_bk_di8_do4_2tx-pac_firmware
  • il_eth_bk_di8_do4_2tx-pac
  • il_eip_bk_di8_do4_2tx-pac
  • axl_f_bk_eip_ef
  • il_eth_bk_di8_do4_2tx-pac_firmware
  • axl_f_bk_eth_xc_firmware
  • axl_f_bk_pn_tps_xc_firmware
  • il_pn_bk_di8_do4_2scrj-pac_firmware
  • il_pn_bk-pac
  • il_s3_bk_di8_do4_2tx-pac
  • axl_f_bk_pn_tps_xc
  • axl_f_bk_pn_tps
  • axl_f_bk_sas_firmware
  • axl_f_bk_pn
  • axl_f_bk_s35_firmware
  • axl_f_bk_pn_xc_firmware
  • axl_f_bk_sas
  • axl_f_bk_pn_firmware
  • axl_f_bk_eth
  • il_pn_bk_di8_do4_2tx-pac
  • axl_f_bk_eip
  • il_eip_bk_di8_do4_2tx-pac_firmware
  • il_pn_bk-pac_firmware
  • axl_f_bk_pn_xc
  • il_eth_bk_di8_do4_2tx-xc-pac
  • axl_f_bk_s35
CWE
CWE-798

Use of Hard-coded Credentials