What’s Vulnerable › Vulnerabilities

CVE-2021-21005: Race Condition Vulnerability in Phoenix Contact FL SWITCH SMCS series products

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-06-25 · updated 2026-06-17
• Weakness: CWE-362

Description

In Phoenix Contact FL SWITCH SMCS series products in multiple versions if an attacker sends a hand-crafted TCP-Packet with the Urgent-Flag set and the Urgent-Pointer set to 0, the network stack will crash. The device needs to be rebooted afterwards.

Affected products

• Phoenixcontact Fl Nat Smn 8Tx-M Firmware: through 4.63
• Phoenixcontact Fl Nat Smn 8Tx Firmware: through 4.63
• Phoenixcontact Fl Switch Smcs 14Tx/2Fx-Sm Firmware: through 4.70
• Phoenixcontact Fl Switch Smcs 14Tx/2Fx Firmware: through 4.70
• Phoenixcontact Fl Switch Smcs 16Tx Firmware: through 4.70
• Phoenixcontact Fl Switch Smcs 4Tx-Pn Firmware: through 4.70
• Phoenixcontact Fl Switch Smcs 6Gt/2Sfp Firmware: through 4.70
• Phoenixcontact Fl Switch Smcs 6Tx/2Sfp Firmware: through 4.70
• Phoenixcontact Fl Switch Smcs 8Gt Firmware: through 4.70
• Phoenixcontact Fl Switch Smcs 8Tx-Pn Firmware: through 4.70
• Phoenixcontact Fl Switch Smcs 8Tx Firmware: through 4.70
• Phoenixcontact Fl Switch Smn 6Tx/2Fx Firmware: through 4.70
• Phoenixcontact Fl Switch Smn 6Tx/2Fx Sm Firmware: through 4.70
• Phoenixcontact Fl Switch Smn 6Tx/2Pof-Pn Firmware: through 4.70
• Phoenixcontact Fl Switch Smn 8Tx-Pn Firmware: through 4.70

References

• https://cert.vde.com/en-us/advisories/vde-2021-023
• https://cert.vde.com/en-us/advisories/vde-2021-023

Get alerted when CVE-2021-21005 or the next vulnerability affects your stack