High severity · published Aug 31, 2021
CVE-2021-34561
In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 serious issue exists, if the application is not externally accessible or uses IP-based access restrictions
8.8
CVSS
0.9%
EPSS
No
On KEV
Description
In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 serious issue exists, if the application is not externally accessible or uses IP-based access restrictions. Attackers can use DNS Rebinding to bypass any IP or firewall based access restrictions that may be in place, by proxying through their target's browser.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WF
Wha-gw-f2d2-0-as-z2-eth Firmware · Pepperl-fuchs
through 3.0.8 · source: NVD
WF
Wha-gw-f2d2-0-as-z2-eth.eip Firmware · Pepperl-fuchs
through 3.0.8 · source: NVD
Affected product
WF
Wha-gw-f2d2-0-as-z2-eth Firmware
Pepperl-fuchs
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-34561
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-34561
Third Party Advisory
https://cert.vde.com/en-us/advisories/vde-2021-027
More from Wha-gw-f2d2-0-as-z2-eth Firmware
9.8
CVE-2021-34565
In PEPPERL+FUCHS WirelessHART-Gateway 3.0.7 to 3.0.9 the SSH and telnet services are active with hard-coded credentials
7.5
CVE-2021-33555
In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.7 the filename parameter is vulnerable to unauthenticated path traversal attacks, enabling read access to arbitrary files on the…
6.1
CVE-2021-34562
In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 it is possible to inject arbitrary JavaScript into the application's response
5.5
CVE-2021-34564
Any cookie-stealing vulnerabilities within the application or browser would enable an attacker to steal the user's credentials to the PEPPERL+FUCHS WirelessHART-Gateway 3.0.9
5.5
CVE-2021-34560
In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.9 a form contains a password field with autocomplete enabled