What’s Vulnerable › Vulnerabilities

CVE-2021-21004: Cross-site Scripting Vulnerability in Phoenix Contact FL SWITCH SMCS series products

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-06-25 · updated 2026-06-17
• Weakness: CWE-79

Description

In Phoenix Contact FL SWITCH SMCS series products in multiple versions an attacker may insert malicious code via LLDP frames into the web-based management which could then be executed by the client.

Affected products

• Phoenixcontact Fl Nat Smn 8Tx-M Firmware: through 4.63
• Phoenixcontact Fl Nat Smn 8Tx Firmware: through 4.63
• Phoenixcontact Fl Switch Smcs 14Tx/2Fx-Sm Firmware: through 4.70
• Phoenixcontact Fl Switch Smcs 14Tx/2Fx Firmware: through 4.70
• Phoenixcontact Fl Switch Smcs 16Tx Firmware: through 4.70
• Phoenixcontact Fl Switch Smcs 4Tx-Pn Firmware: through 4.70
• Phoenixcontact Fl Switch Smcs 6Gt/2Sfp Firmware: through 4.70
• Phoenixcontact Fl Switch Smcs 6Tx/2Sfp Firmware: through 4.70
• Phoenixcontact Fl Switch Smcs 8Gt Firmware: through 4.70
• Phoenixcontact Fl Switch Smcs 8Tx-Pn Firmware: through 4.70
• Phoenixcontact Fl Switch Smcs 8Tx Firmware: through 4.70
• Phoenixcontact Fl Switch Smn 6Tx/2Fx Firmware: through 4.70
• Phoenixcontact Fl Switch Smn 6Tx/2Fx Sm Firmware: through 4.70
• Phoenixcontact Fl Switch Smn 6Tx/2Pof-Pn Firmware: through 4.70
• Phoenixcontact Fl Switch Smn 8Tx-Pn Firmware: through 4.70

References

• https://cert.vde.com/en-us/advisories/vde-2021-023
• https://cert.vde.com/en-us/advisories/vde-2021-023

Get alerted when CVE-2021-21004 or the next vulnerability affects your stack