CVE-2021-20986

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A Denial of Service vulnerability was found in Hilscher PROFINET IO Device V3 in versions prior to V3.14.0.7. This may lead to unexpected loss of cyclic communication or interruption of acyclic communication.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Hilscher	PROFINET IO Device	>= V3, < V3.14.0.7
Pepper+Fuchs	PCV/PXV/PGV	>= PGV100-F200A-B17-V1D, PGV150I-F200A-B17-V1D, PGV100-F200-B17-V1D-7477, <= V2.0.0; >= PXV100-F200-B17-V1D, PXV100-F200-B17-V1D-3636, <= V4.2.0; >= PCV80-F200-B17-V1D, PCV100-F200-B17-V1D, PCV50-F200-B17-V1D, PCV100-F200-B17-V1D-6011-6997, <= V3.2.3; >= PCV100-F200-B17-V1D-6011, PCV100-F200-B17-V1D-6011-8203, <= V3.2.5
Pepper+Fuchs	PXV/PGV B28 Profisafe	>= PXV100A-F200-B28-V1D, PXV100A-F200-B28-V1D-6011, PGV100A-F200-B28-V1D, PGV100A-F200A-B28-V1D, <= V1.0.3; >= PGV100AQ-F200A-B28-V1D, PGV100AQ-F200-B28-V1D, PXV100AQ-F200-B28-V1D, PXV100AQ-F200-B28-V1D-6011, <= V2.1.1
Pepper+Fuchs	OHV	>= OHV-F230-B17, <= V1.1.0
Pepper+Fuchs	OIT	>= OIT500-F113-B17-CB, <= V1.3.4
Pepper+Fuchs	PHA	>= PHA300-F200-B17-V1D, PHA400-F200-B17-V1D, PHA300-F200A-B17-V1D, PHA300-F200-B17-T-V1D, PHA200-F200A-B17-V1D, PHA200-F200-B17-V1D, PHA400-F200A-B17-V1D, PHA300-F200A-B17-T-V1D, PHA600-F200A-B17-V1D, PHA500-F200-B17-V1D, PHA500-F200A-B17-V1D, PHA600-F200-B17-V1D, PHA150-F200A-B17-V1D, PHA200-F200A-B17-T-V1D, PHA150-F200-B17-V1D, PHA800-F200-B17-V1D, PHA400-F200A-B17-T-V1D, PHA500-F200A-B17-T-V1D, PHA700-F200-B17-V1D, <= V3.1.5
Pepper+Fuchs	WCS	>= WCS3B-LS610, WCS3B-LS610H, WCS3B-LS610D, WCS3B-LS610DH, WCS3B-LS610H-OM, WCS3B-LS610DH-OM, WCS3B-LS610D-OM, CS3B-LS610-OM, <= V3.0.0

References

https://cert.vde.com/en-us/advisories/vde-2021-006Third Party Advisory
https://kb.hilscher.com/display/ISMS/2020-12-03+Denial+of+Service+vulnerability+in+PROFINET+IO+DeviceVendor Advisory
https://cert.vde.com/en-us/advisories/vde-2021-006Third Party Advisory
https://kb.hilscher.com/display/ISMS/2020-12-03+Denial+of+Service+vulnerability+in+PROFINET+IO+DeviceVendor Advisory

Timeline

Published: Feb 16, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-209878.6A denial of service and memory corruption vulnerability was found in Hilscher EtherNet/IP Core V2 prior to V2.13.0.21that may lead to code i CVE-2021-209887.5In Hilscher rcX RTOS versions prios to V2.1.14.1 the actual UDP packet length is not verified against the length indicated by the packet. Th CVE-2021-209895.9Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older initiate SSH connections to the Fibaro cloud to provide remote a CVE-2021-20998.2Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that ar CVE-2021-209907.5In Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older an internal management service is accessible on port 8000 and CVE-2021-209918.8In Fibaro Home Center 2 and Lite devices with firmware version 4.540 and older an authenticated user can run commands as root user using a c CVE-2021-209927.5In Fibaro Home Center 2 and Lite devices in all versions provide a web based management interface over unencrypted HTTP protocol. Communicat CVE-2021-209935.3In multiple managed switches by WAGO in different versions the activated directory listing provides an attacker with the index of the resour CVE-2021-209946.1In multiple managed switches by WAGO in different versions an attacker may trick a legitimate user to click a link to inject possible malici CVE-2021-209957.5In multiple managed switches by WAGO in different versions the webserver cookies of the web based UI contain user credentials.CVE-2021-209965.3In multiple managed switches by WAGO in different versions special crafted requests can lead to cookies being transferred to third parties.CVE-2021-209977.5In multiple managed switches by WAGO in different versions it is possible to read out the password hashes of all Web-based Management users.