CVE-2021-34561
published 2021-08-31CVE-2021-34561: In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 serious issue exists, if the application is not externally accessible or uses IP-based access restrictions…
PriorityP345high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.87%
54.6th percentile
In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 serious issue exists, if the application is not externally accessible or uses IP-based access restrictions. Attackers can use DNS Rebinding to bypass any IP or firewall based access restrictions that may be in place, by proxying through their target's browser.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| pepperl-fuchs | wha-gw-f2d2-0-as-z2-eth.eip_firmware | <= 3.0.8 | — |
| pepperl-fuchs | wha-gw-f2d2-0-as-z2-eth_firmware | <= 3.0.8 | — |
| phoenix_contact | wha-gw-f2d2-0-as_z2-eth | 3.0.8 – 3.0.8 | — |
| phoenix_contact | wha-gw-f2d2-0-as_z2-eth.eip | 3.0.8 – 3.0.8 | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Pepperl+Fuchs WirelessHART-Gateway
cisa_ics·2022-04-07·CVSS 7.5
[HIGH] Pepperl+Fuchs WirelessHART-Gateway
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Pepperl+Fuchs WirelessHART-Gateway
Last RevisedApril 07, 2022
Alert CodeICSA-22-097-01
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Pepperl+Fuchs
- Equipment: WirelessHART-Gateway
- Vulnerabilities: Use of Hard-coded Credentials, Uncontrolled Resource Consumption, Reliance on Reverse DNS Resolution for a Security-critical Action, Path Traversal, Cross-site Scripting, Exposure of Sensitive Information to an Unauthorized Actor, Cleartext Storage of Sensitive Information in a Cookie, HTTP Request Smuggling, Sensitive Co
GHSA
GHSA-9fh3-r25p-cgrm: In PEPPERL+FUCHS WirelessHART-Gateway <= 3
ghsa_unreviewed·2022-05-24
CVE-2021-34561 [HIGH] CWE-350 GHSA-9fh3-r25p-cgrm: In PEPPERL+FUCHS WirelessHART-Gateway <= 3
In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 serious issue exists, if the application is not externally accessible or uses IP-based access restrictions. Attackers can use DNS Rebinding to bypass any IP or firewall based access restrictions that may be in place, by proxying through their target's browser.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-08-31
Published