Skip to content
OpenAdvisories
High VDE-2021-023 3 CVEs

PHOENIX CONTACT: Security Advisory for FL SWITCH SMCS series

Published Jun 23, 2021 · Updated May 14, 2025 · Revision 3

Vendor: Phoenix Contact Product: FL NAT SMN 8TX Product: FL NAT SMN 8TX-M Product: FL SWITCH SMCS 14TX/2FX Product: FL SWITCH SMCS 14TX/2FX-SM Product: FL SWITCH SMCS 16TX Product: FL SWITCH SMCS 4TX-PN Product: FL SWITCH SMCS 6GT/2SFP Product: FL SWITCH SMCS 6TX/2SFP Product: FL SWITCH SMCS 8GT Product: FL SWITCH SMCS 8TX Product: FL SWITCH SMCS 8TX-PN Product: FL SWITCH SMN 6TX/2FX Product: FL SWITCH SMN 6TX/2FX SM Product: FL SWITCH SMN 6TX/2POF-PN Product: FL SWITCH SMN 8TX-PN

Summary

Multiple vulnerabilities have been discovered in the current firmware of the PHOENIX CONTACT FL SWITCH SMCS series switches.

Details

Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note:
Measures to protect network-capable devices with Ethernet connection

Vulnerabilities 3

  • High 7.5
    CVE-2021-21005

    Race Condition Vulnerability in Phoenix Contact FL SWITCH SMCS series products

    In Phoenix Contact FL SWITCH SMCS series products in multiple versions if an attacker sends a hand-crafted TCP-Packet with the Urgent-Flag set and the Urgent-Pointer set to 0, the network stack will crash. The device needs to be rebooted afterwards.

    Phoenix Contact FL NAT FL SWITCH ICS / OT
  • High 7.4
    CVE-2021-21004

    Cross-site Scripting Vulnerability in Phoenix Contact FL SWITCH SMCS series products

    In Phoenix Contact FL SWITCH SMCS series products in multiple versions an attacker may insert malicious code via LLDP frames into the web-based management which could then be executed by the client.

    Phoenix Contact FL NAT FL SWITCH ICS / OT
  • Medium 5.3
    CVE-2021-21003

    Denial of Service Vulnerability in Phoenix Contact FL SWITCH SMCS series products

    In Phoenix Contact FL SWITCH SMCS series products in multiple versions fragmented TCP-Packets may cause a Denial of Service of Web-, SNMP- and ICMP-Echo services. The switching functionality of the device is not affected.

    Phoenix Contact FL SWITCH FL NAT ICS / OT

Revision history

  1. #3

    Fix: version space, added distribution

  2. #2

    Update: Provider data has been corrected

  3. #1

    Initial revision.

References