CVE-2021-33542
CVSS V2 Medium 5.1
CVSS V3 High 7
Description
Phoenix Contact Classic Automation Worx Software Suite in Version 1.87 and below is affected by a remote code execution vulnerability. Manipulated PC Worx or Config+ projects could lead to a remote code execution when unallocated memory is freed because of incompletely initialized data. The attacker needs to get access to an original bus configuration file (*.bcp) to be able to manipulate data inside. After manipulation the attacker needs to exchange the original file by the manipulated one on the application programming workstation. Availability, integrity, or confidentiality of an application programming workstation might be compromised by attacks using these vulnerabilities. Automated systems in operation which were programmed with one of the above-mentioned products are not affected.
Overview
- CVE ID
- CVE-2021-33542
- Assigner
- info@cert.vde.com
- Vulnerability Status
- Analyzed
- Published Version
- 2021-06-25T19:15:09
- Last Modified Date
- 2021-09-20T18:51:15
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:phoenixcontact:config\+:*:*:*:*:*:*:*:* | 1 | OR | 1.87 | |
| cpe:2.3:a:phoenixcontact:pc_worx:*:*:*:*:*:*:*:* | 1 | OR | 1.87 | |
| cpe:2.3:a:phoenixcontact:pc_worx_express:*:*:*:*:*:*:*:* | 1 | OR | 1.87 |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:H/Au:N/C:P/I:P/A:P
- Access Vector
- NETWORK
- Access Compatibility
- HIGH
- Authentication
- NONE
- Confidentiality Impact
- PARTIAL
- Integrity Impact
- PARTIAL
- Availability Impact
- PARTIAL
- Base Score
- 5.1
- Severity
- MEDIUM
- Exploitability Score
- 4.9
- Impact Score
- 6.4
CVSS Version 3
- Version
- 3.1
- Vector String
- CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack Vector
- LOCAL
- Attack Compatibility
- HIGH
- Privileges Required
- NONE
- User Interaction
- REQUIRED
- Scope
- UNCHANGED
- Confidentiality Impact
- HIGH
- Availability Impact
- HIGH
- Base Score
- 7
- Base Severity
- HIGH
- Exploitability Score
- 1
- Impact Score
- 5.9
References
| Reference URL | Reference Tags |
|---|---|
| https://cert.vde.com/en-us/advisories/vde-2021-020 | Third Party Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-21-782/ | Third Party Advisory VDB Entry |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2021-33542 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33542 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 16:04:22 | Added to TrackCVE | |||
| 2022-12-05 05:03:42 | 2021-06-25T19:15Z | 2021-06-25T19:15:09 | CVE Published Date | updated |
| 2022-12-05 05:03:42 | 2021-09-20T18:51:15 | CVE Modified Date | updated | |
| 2022-12-05 05:03:42 | Analyzed | Vulnerability Status | updated |