CVE-2021-34579

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Phoenix Contact: FL MGUARD DM version 1.12.0 and 1.13.0 access to the Apache web server being installed as part of the FL MGUARD DM on Microsoft Windows does not require login credentials even if configured during installation.Attackers with network access to the Apache web server can download and therefore read mGuard configuration profiles (“ATV profiles”). Such configuration profiles may contain sensitive information, e.g. private keys associated with IPsec VPN connections.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published: Nov 9, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-34584.6The Motorola MM1000 device configuration portal can be accessed without authentication, which could allow adapter settings to be modified.CVE-2021-345807.5In mymbCONNECT24, mbCONNECT24 <= 2.9.0 an unauthenticated user can enumerate valid backend users by checking what kind of response the serve CVE-2021-345817.5Missing Release of Resource after Effective Lifetime vulnerability in OpenSSL implementation of WAGO 750-831/xxx-xxx, 750-880/xxx-xxx, 750-8 CVE-2021-345824.8In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 a user with high privileges can inject HTML code (XSS) through CVE-2021-345837.5Crafted web server requests may cause a heap-based buffer overflow and could therefore trigger a denial-of- service condition due to a crash CVE-2021-345849.1Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service condition due to a cras CVE-2021-345857.5In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests can trigger a parser error. Since the parser result is not check CVE-2021-345867.5In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests may cause a Null pointer dereference in the CODESYS web server a CVE-2021-345875.3In Bender/ebee Charge Controllers in multiple versions a long URL could lead to webserver crash. The URL is used as input of an sprintf to a CVE-2021-345888.6In Bender/ebee Charge Controllers in multiple versions are prone to unprotected data export. Backup export is protected via a random key. Th CVE-2021-345897.5In Bender/ebee Charge Controllers in multiple versions are prone to an RFID leak. The RFID of the last charge event can be read without auth CVE-2021-34596.8A privilege escalation vulnerability was reported in the MM1000 device configuration web server, which could allow privileged shell access a