CVE-2021-21002: Denial of Service in Phoenix Contact FL COMSERVER UNI products

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-25 · updated 2026-06-17
Weakness: CWE-772

Description

In Phoenix Contact FL COMSERVER UNI in versions < 2.40 a invalid Modbus exception response can lead to a temporary denial of service.

Affected products

Phoenixcontact Fl Comserver Uni 232/422/485-T Firmware: before 2.40 — fixed in 2.40
Phoenixcontact Fl Comserver Uni 232/422/485 Firmware: before 2.40 — fixed in 2.40

How to fix

Upgrade to a fixed version: Phoenixcontact Fl Comserver Uni 232/422/485-T Firmware 2.40; Phoenixcontact Fl Comserver Uni 232/422/485 Firmware 2.40. Check the vendor advisory for mitigations.

References

https://cert.vde.com/en-us/advisories/vde-2021-022
https://cert.vde.com/en-us/advisories/vde-2021-022

Get alerted when CVE-2021-21002 or the next vulnerability affects your stack