Advisories · Technology

Phoenix Contact WHA-GW-F2D2-0-AS- Z2-ETH.

Every CVE that names Phoenix Contact WHA-GW-F2D2-0-AS- Z2-ETH among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2021-34565 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

In WirelessHART-Gateway versions 3.0.7 to 3.0.9 hard-coded credentials have been found
- Phoenix Contact WHA-GW-F2D2-0-AS- Z2-ETH
- Phoenix Contact WHA-GW-F2D2-0-AS- Z2-ETH.EIP
- Hard-coded credentials
Not analysed yet 31 Aug 2021
CVE-2021-34564 CVE record

CVSS 5.5 Medium

In WirelessHART-Gateway versions 3.0.9 a vulnerability allows to read and write sensitive data in a cookie
- Phoenix Contact WHA-GW-F2D2-0-AS- Z2-ETH
- Phoenix Contact WHA-GW-F2D2-0-AS- Z2-ETH.EIP
- CWE-315
Not analysed yet 31 Aug 2021
CVE-2021-34563 CVE record

CVSS 3.3 Low

In WirelessHART-Gateway versions 3.0.8 and 3.0.9 the HttpOnly flag is missing in a cookie which allows client-side javascript to modify it
- Phoenix Contact WHA-GW-F2D2-0-AS- Z2-ETH
- Phoenix Contact WHA-GW-F2D2-0-AS- Z2-ETH.EIP
- CWE-1004
Not analysed yet 31 Aug 2021
CVE-2021-34562 CVE record

CVSS 5.4 Medium

A vulnerability in WirelessHART-Gateway 3.0.8 it is possible to inject arbitrary JavaScript into the application's response
- Phoenix Contact WHA-GW-F2D2-0-AS- Z2-ETH
- Phoenix Contact WHA-GW-F2D2-0-AS- Z2-ETH.EIP
- Cross-site scripting (XSS)
Not analysed yet 31 Aug 2021
CVE-2021-34561 CVE record

CVSS 7.5 High

A vulnerability in WirelessHART-Gateway <= 3.0.8 allows to bypass any IP or firewall based access restrictions through DNS rebinding
- Phoenix Contact WHA-GW-F2D2-0-AS- Z2-ETH
- Phoenix Contact WHA-GW-F2D2-0-AS- Z2-ETH.EIP
- CWE-350
Not analysed yet 31 Aug 2021
CVE-2021-34560 CVE record

CVSS 5.5 Medium

A vulnerability in WirelessHART-Gateway <= 3.0.9 could lead to information exposure of sensitive information
- Phoenix Contact WHA-GW-F2D2-0-AS- Z2-ETH
- Phoenix Contact WHA-GW-F2D2-0-AS- Z2-ETH.EIP
- Hard-coded credentials
Not analysed yet 31 Aug 2021
CVE-2021-34559 CVE record

CVSS 5.4 Medium

A vulnerability in WirelessHART-Gateway <= 3.0.8 may allow remote attackers to rewrite links and URLs in cached pages to arbitrary strings
- Phoenix Contact WHA-GW-F2D2-0-AS- Z2-ETH
- Phoenix Contact WHA-GW-F2D2-0-AS- Z2-ETH.EIP
- HTTP request smuggling
Not analysed yet 31 Aug 2021
CVE-2021-33555 CVE record

CVSS 7.5 High

A vulnerability may allow remote attackers to read arbitrary files on the server of the WirelessHART-Gateway
- Phoenix Contact WHA-GW-F2D2-0-AS- Z2-ETH
- Phoenix Contact WHA-GW-F2D2-0-AS- Z2-ETH.EIP
- Path traversal
Not analysed yet 31 Aug 2021