CVE-2021-34597

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Improper Input Validation vulnerability in PC Worx Automation Suite of Phoenix Contact up to version 1.88 could allow an attacker with a manipulated project file to unpack arbitrary files outside of the selected project directory.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
Phoenix ContactPC Worx>= PC Worx, <= 1.88; >= PC Worx-Express, <= 1.88

References

Timeline

Published
Nov 4, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-345987.5In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 the remote logging functionality is impaired by the lack of meCVE-2021-345997.4Affected versions of CODESYS Git in Versions prior to V1.1.0.0 lack certificate validation in HTTPS handshakes. CODESYS Git does not implemeCVE-2021-34609.8The Motorola MH702x devices, prior to version 2.0.0.301, do not properly verify the server certificate during communication with the supportCVE-2021-346005.5Telenot CompasX versions prior to 32.0 use a weak seed for random number generation leading to predictable AES keys used in the NFC tags useCVE-2021-346019.8In Bender/ebee Charge Controllers in multiple versions are prone to Hardcoded Credentials. Bender charge controller CC612 in version 5.20.1 CVE-2021-346028.8In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could entCVE-2021-346057.3A zip slip vulnerability in XINJE XD/E Series PLC Program Tool up to version v3.5.1 can provide an attacker with arbitrary file write privilCVE-2021-346067.3A vulnerability exists in XINJE XD/E Series PLC Program Tool in versions up to v3.5.1 that can allow an authenticated, local attacker to loaCVE-2021-346098.8A remote SQL injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. Aruba haCVE-2021-34617.1A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity providerCVE-2021-346107.2A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6CVE-2021-346117.2A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6
CVE-2021-34597: High severity, CVSS 7.8 | Vulnix