Description
In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.9 a form contains a password field with autocomplete enabled. The stored credentials can be captured by an attacker who gains control over the user's computer. Therefore the user must have logged in at least once.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Phoenix Contact | WHA-GW-F2D2-0-AS- Z2-ETH | 3.0.9 – ≤ 3.0.9 | — |
| Phoenix Contact | WHA-GW-F2D2-0-AS- Z2-ETH.EIP | 3.0.9 – ≤ 3.0.9 | — |
Advisories 2
- VDE-2021-027 Pepperl+Fuchs: WirelessHART-Gateway - Vulnerability may allow remote attackers to cause a Denial Of Service CERT@VDE · May 14, 2025
- ICSA-22-097-01 Pepperl+Fuchs WirelessHART-Gateway CISA ICS & IT advisories · Apr 7, 2022