CVE-2021-34564

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Any cookie-stealing vulnerabilities within the application or browser would enable an attacker to steal the user's credentials to the PEPPERL+FUCHS WirelessHART-Gateway 3.0.9.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-315

Affected software

Vendor	Product	Versions
Phoenix Contact	WHA-GW-F2D2-0-AS- Z2-ETH	3.0.9
Phoenix Contact	WHA-GW-F2D2-0-AS- Z2-ETH.EIP	3.0.9

References

https://cert.vde.com/en-us/advisories/vde-2021-027Third Party Advisory
https://cert.vde.com/en-us/advisories/vde-2021-027Third Party Advisory

Timeline

Published: Aug 31, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-345659.8In PEPPERL+FUCHS WirelessHART-Gateway 3.0.7 to 3.0.9 the SSH and telnet services are active with hard-coded credentials.CVE-2021-345669.1In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands CVE-2021-345678.2In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands CVE-2021-345687.5In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands CVE-2021-345699.8In WAGO I/O-Check Service in multiple products an attacker can send a specially crafted packet containing OS commands to crash the diagnosti CVE-2021-34576.1An improper authorization handling flaw was found in Foreman. The Shellhooks plugin for the smart-proxy allows Foreman clients to execute ac CVE-2021-345707.5Multiple Phoenix Contact PLCnext control devices in versions prior to 2021.0.5 LTS are prone to a DoS attack through special crafted JSON re CVE-2021-345716.5Multiple Wireless M-Bus devices by Enbra use Hard-coded Credentials in Security mode 5 without an option to change the encryption key. An ad CVE-2021-345726.5Enbra EWM 1.7.29 does not check for or detect replay attacks sent by wireless M-Bus Security mode 5 devices. Instead timestamps of the senso CVE-2021-345735.5In Enbra EWM in Version 1.7.29 together with several tested wireless M-Bus Sensors the events backflow and "no flow" are not reconized or mi CVE-2021-345744.3In MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 an authenticated atta CVE-2021-345757.5In MB connect line mymbCONNECT24, mbCONNECT24 in versions <= 2.8.0 an unauthenticated user can enumerate valid users by checking what kind o