CVE-2021-34560

CWE-522 — Insufficiently Protected CredentialsCWE-200 — Information Exposure3 documents3 sources
Severity
5.5MEDIUM
EPSS
0.1%
top 83.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Phoenix Contact Wha-gw-f2d2-0-as- Z2-ethPhoenix Contact Wha-gw-f2d2-0-as- Z2-eth.eipPepperl-fuchs Wha-gw-f2d2-0-as-z2-eth.eip Firmware+1 more
Timeline
PublishedAug 31
Latest updateMay 24

Description

In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.9 a form contains a password field with autocomplete enabled. The stored credentials can be captured by an attacker who gains control over the user's computer. Therefore the user must have logged in at least once.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

▶CVEListV5phoenix_contact/wha-gw-f2d2-0-as-_z2-eth3.0.9 — 3.0.9

🔴Vulnerability Details

2
GHSA
GHSA-f2pw-r5rx-m6w6: In PEPPERL+FUCHS WirelessHART-Gateway <= 3↗2022-05-24
▶
CVEList
A vulnerability in WirelessHART-Gateway <= 3.0.9 could lead to information exposure of sensitive information↗2021-08-31
▶