CVE-2021-34560

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.9 a form contains a password field with autocomplete enabled. The stored credentials can be captured by an attacker who gains control over the user's computer. Therefore the user must have logged in at least once.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
Phoenix Contact	WHA-GW-F2D2-0-AS- Z2-ETH	>= 3.0.9, <= 3.0.9
Phoenix Contact	WHA-GW-F2D2-0-AS- Z2-ETH.EIP	>= 3.0.9, <= 3.0.9

References

https://cert.vde.com/en-us/advisories/vde-2021-027Third Party Advisory
https://cert.vde.com/en-us/advisories/vde-2021-027Third Party Advisory

Timeline

Published: Aug 31, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-345618.8In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 serious issue exists, if the application is not externally accessible or uses IP-based access CVE-2021-345626.1In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 it is possible to inject arbitrary JavaScript into the application's response.CVE-2021-345633.3In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie. This allows the cookie's value to be re CVE-2021-345645.5Any cookie-stealing vulnerabilities within the application or browser would enable an attacker to steal the user's credentials to the PEPPER CVE-2021-345659.8In PEPPERL+FUCHS WirelessHART-Gateway 3.0.7 to 3.0.9 the SSH and telnet services are active with hard-coded credentials.CVE-2021-345669.1In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands CVE-2021-345678.2In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands CVE-2021-345687.5In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands CVE-2021-345699.8In WAGO I/O-Check Service in multiple products an attacker can send a specially crafted packet containing OS commands to crash the diagnosti CVE-2021-34576.1An improper authorization handling flaw was found in Foreman. The Shellhooks plugin for the smart-proxy allows Foreman clients to execute ac CVE-2021-345707.5Multiple Phoenix Contact PLCnext control devices in versions prior to 2021.0.5 LTS are prone to a DoS attack through special crafted JSON re CVE-2021-345716.5Multiple Wireless M-Bus devices by Enbra use Hard-coded Credentials in Security mode 5 without an option to change the encryption key. An ad