Medium severity · published Aug 31, 2021
CVE-2021-34560
In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.9 a form contains a password field with autocomplete enabled
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.9 a form contains a password field with autocomplete enabled. The stored credentials can be captured by an attacker who gains control over the user's computer. Therefore the user must have logged in at least once.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WF
Wha-gw-f2d2-0-as-z2-eth Firmware · Pepperl-fuchs
through 3.0.9 · source: NVD
WF
Wha-gw-f2d2-0-as-z2-eth.eip Firmware · Pepperl-fuchs
through 3.0.9 · source: NVD
Affected product
WF
Wha-gw-f2d2-0-as-z2-eth Firmware
Pepperl-fuchs
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-34560
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-34560
Third Party Advisory
https://cert.vde.com/en-us/advisories/vde-2021-027
More from Wha-gw-f2d2-0-as-z2-eth Firmware
9.8
CVE-2021-34565
In PEPPERL+FUCHS WirelessHART-Gateway 3.0.7 to 3.0.9 the SSH and telnet services are active with hard-coded credentials
8.8
CVE-2021-34561
In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 serious issue exists, if the application is not externally accessible or uses IP-based access restrictions
7.5
CVE-2021-33555
In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.7 the filename parameter is vulnerable to unauthenticated path traversal attacks, enabling read access to arbitrary files on the…
6.1
CVE-2021-34562
In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 it is possible to inject arbitrary JavaScript into the application's response
5.5
CVE-2021-34564
Any cookie-stealing vulnerabilities within the application or browser would enable an attacker to steal the user's credentials to the PEPPERL+FUCHS WirelessHART-Gateway 3.0.9