CVE-2021-20987

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

A denial of service and memory corruption vulnerability was found in Hilscher EtherNet/IP Core V2 prior to V2.13.0.21that may lead to code injection through network or make devices crash without recovery.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Hilscher	EtherNet/IP Core V2	>= V2, < V2.13.0.21
Pepper+Fuchs	PCV/PXV/PGV	>= PXV100-F200-B25-V1D, PXV100I-F200-B25-V1D, PCV100-F200-B25-V1D-6011-6720, PCV50-F200-B25-V1D, PCV80-F200-B25-V1D, PCV100-F200-B25-V1D-6011, <= V1.10.0
Pepper+Fuchs	WCS	>= WCS3B-LS510, WCS3B-LS510H, WCS3B-LS510D, WCS3B-LS510DH, WCS3B-LS510H-OM, WCS3B-LS510DH-OM, WCS3B-LS510D-OM, WCS3B-LS510-OM, <= V1.2.1

References

https://cert.vde.com/en-us/advisories/vde-2021-007Third Party Advisory
https://kb.hilscher.com/pages/viewpage.action?pageId=108969480Vendor Advisory
https://cert.vde.com/en-us/advisories/vde-2021-007Third Party Advisory
https://kb.hilscher.com/pages/viewpage.action?pageId=108969480Vendor Advisory

Timeline

Published: Feb 16, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-209887.5In Hilscher rcX RTOS versions prios to V2.1.14.1 the actual UDP packet length is not verified against the length indicated by the packet. Th CVE-2021-209895.9Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older initiate SSH connections to the Fibaro cloud to provide remote a CVE-2021-20998.2Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that ar CVE-2021-209907.5In Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older an internal management service is accessible on port 8000 and CVE-2021-209918.8In Fibaro Home Center 2 and Lite devices with firmware version 4.540 and older an authenticated user can run commands as root user using a c CVE-2021-209927.5In Fibaro Home Center 2 and Lite devices in all versions provide a web based management interface over unencrypted HTTP protocol. Communicat CVE-2021-209935.3In multiple managed switches by WAGO in different versions the activated directory listing provides an attacker with the index of the resour CVE-2021-209946.1In multiple managed switches by WAGO in different versions an attacker may trick a legitimate user to click a link to inject possible malici CVE-2021-209957.5In multiple managed switches by WAGO in different versions the webserver cookies of the web based UI contain user credentials.CVE-2021-209965.3In multiple managed switches by WAGO in different versions special crafted requests can lead to cookies being transferred to third parties.CVE-2021-209977.5In multiple managed switches by WAGO in different versions it is possible to read out the password hashes of all Web-based Management users.CVE-2021-209989.8In multiple managed switches by WAGO in different versions without authorization and with specially crafted packets it is possible to create