CVE-2021-34582

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 a user with high privileges can inject HTML code (XSS) through web-based management or the REST API with a manipulated certificate file.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
PHOENIX CONTACT	FL MGUARD	>= 1.4.0, < FL MGUARD 1102 (No. 1153079); >= 1.4.0, < FL MGUARD 1105 (No. 1153078)

References

https://cert.vde.com/en/advisories/VDE-2021-046/Third Party Advisory
https://cert.vde.com/en/advisories/VDE-2021-046/Third Party Advisory

Timeline

Published: Nov 10, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-345837.5Crafted web server requests may cause a heap-based buffer overflow and could therefore trigger a denial-of- service condition due to a crash CVE-2021-345849.1Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service condition due to a cras CVE-2021-345857.5In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests can trigger a parser error. Since the parser result is not check CVE-2021-345867.5In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests may cause a Null pointer dereference in the CODESYS web server a CVE-2021-345875.3In Bender/ebee Charge Controllers in multiple versions a long URL could lead to webserver crash. The URL is used as input of an sprintf to a CVE-2021-345888.6In Bender/ebee Charge Controllers in multiple versions are prone to unprotected data export. Backup export is protected via a random key. Th CVE-2021-345897.5In Bender/ebee Charge Controllers in multiple versions are prone to an RFID leak. The RFID of the last charge event can be read without auth CVE-2021-34596.8A privilege escalation vulnerability was reported in the MM1000 device configuration web server, which could allow privileged shell access a CVE-2021-345905.4In Bender/ebee Charge Controllers in multiple versions are prone to Cross-site Scripting. An authenticated attacker could write HTML Code in CVE-2021-345917.8In Bender/ebee Charge Controllers in multiple versions are prone to Local privilege Escalation. An authenticated attacker could get root acc CVE-2021-345928.8In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could ent CVE-2021-345937.5In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid requests may result in se