CVE-2021-21004

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

In Phoenix Contact FL SWITCH SMCS series products in multiple versions an attacker may insert malicious code via LLDP frames into the web-based management which could then be executed by the client.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Phoenix Contact	FL SWITCH	>= SMCS 16TX (2700996), <= 4.70; >= SMCS 14TX/2FX (2700997), <= 4.70; >= SMCS 14TX/2FX-SM (2701466), <= 4.70; >= SMCS 8GT (2891123), <= 4.70; >= SMCS 6GT/2SFP (2891479), <= 4.70; >= SMCS 8TX-PN (2989103), <= 4.70; >= SMCS 4TX-PN (2989093), <= 4.70; >= SMCS 8TX (2989226), <= 4.70; >= SMCS 6TX/2SFP (2989323), <= 4.70; >= SMN 6TX/2POF-PN (2700290), <= 4.70; >= SMN 8TX-PN (2989501), <= 4.70; >= SMN 6TX/2FX (2989543), <= 4.70; >= SMN 6TX/2FX SM (2989556), <= 4.70
Phoenix Contact	FL NAT	>= SMN 8TX (2989365), <= 4.63; >= SMN 8TX-M (2702443), <= 4.63

References

https://cert.vde.com/en-us/advisories/vde-2021-023Not Applicable, Third Party Advisory
https://cert.vde.com/en-us/advisories/vde-2021-023Not Applicable, Third Party Advisory

Timeline

Published: Jun 25, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-210057.5In Phoenix Contact FL SWITCH SMCS series products in multiple versions if an attacker sends a hand-crafted TCP-Packet with the Urgent-Flag s CVE-2021-210068.6Adobe Photoshop version 22.1 (and earlier) is affected by a heap buffer overflow vulnerability when handling a specially crafted font file. CVE-2021-210077.0Adobe Illustrator version 25.0 (and earlier) is affected by an uncontrolled search path element that could result in arbitrary code executio CVE-2021-210087.0Adobe Animate version 21.0 (and earlier) is affected by an uncontrolled search path element that could result in arbitrary code execution in CVE-2021-210098.6Adobe Campaign Classic Gold Standard 10 (and earlier), 20.3.1 (and earlier), 20.2.3 (and earlier), 20.1.3 (and earlier), 19.2.3 (and earlier CVE-2021-21019.1Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Print Server). Supported versions that are CVE-2021-210107.0InCopy version 15.1.1 (and earlier) for Windows is affected by an uncontrolled search path vulnerability that could result in arbitrary code CVE-2021-210117.0Adobe Captivate 2019 version 11.5.1.499 (and earlier) is affected by an uncontrolled search path element vulnerability that could lead to pr CVE-2021-210125.3Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object vulnerabili CVE-2021-210138.1Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object vulnerabili CVE-2021-210149.1Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a file upload restriction bypass. Suc CVE-2021-210158.0Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an OS command injection via the custo