CVE-2021-21002 Denial of Service in Phoenix Contact FL COMSERVER UNI products
An attacker can cause a temporary denial of service in Phoenix Contact FL COMSERVER UNI devices by sending invalid Modbus exception responses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-21002?
CVE-2021-21002 is a high-severity denial of service vulnerability in Phoenix Contact FL COMSERVER, published on 25 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Phoenix Contact FL COMSERVER UNI in versions < 2.40 a invalid Modbus exception response can lead to a temporary denial of service.
Weakness: CWE-772
Which versions are affected by CVE-2021-21002?
It affects 2 products.
Products include Phoenixcontact Fl Comserver Uni 232\/422\/485-T Firmware, Phoenixcontact Fl Comserver Uni 232\/422\/485 Firmware.
How do I fix CVE-2021-21002?
No fix has been published for CVE-2021-21002 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-21002 being exploited?
There is no known exploitation of CVE-2021-21002 in the wild and no public exploit code.
Sources
Also known as GHSA-wc86-7c83-q7g5.