VDE-2021-022 — PHOENIX CONTACT: Security Advisory for FL COMSERVER UNI

Summary

When the communication partner sends an invalid Modbus exception response to the FL COMSERVER UNI as a query, the Modbus communication stops, and the device will be unresponsive for some minutes before the functionality is fully restored (CWE-772).

Details

Remediation
PHOENIX CONTACT recommends affected users to upgrade to the latest firmware version which is available for download.
| **Product Number** | **Product Name** | **Firmware Version** |
|--------------------|------------------------------------|-----------------------------|
| 2313452 | FL COMSERVER UNI 232/422/485 | 2.41 |
| 2904817 | FL COMSERVER UNI 232/422/485-T | 2.41 |

Impact
An attacker may use this vulnerability to execute a Denial of Service (DoS) attack.

Vulnerabilities 1

High 7.5

CVE-2021-21002

Denial of Service in Phoenix Contact FL COMSERVER UNI products

In Phoenix Contact FL COMSERVER UNI in versions < 2.40 a invalid Modbus exception response can lead to a temporary denial of service.

Phoenix Contact FL COMSERVER ICS / OT

Jun 25, 2021

Revision history

2025-05-14 #3
Fix: version space, firmware category, added distribution
2025-02-10 #2
Update: Provider data has been corrected
2021-06-23 #1
Initial revision.

References

PHOENIX CONTACT advisory overview at CERT@VDE
https://certvde.com/en/advisories/vendor/phoenixcontact/
VDE-2021-022: PHOENIX CONTACT: Security Advisory for FL COMSERVER UNI - HTML
https://certvde.com/en/advisories/VDE-2021-022