What’s Vulnerable › Vulnerabilities
CVE-2021-30064
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.9% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2022-04-03 · updated 2026-06-17
- Weakness: CWE-798
Description
On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, an SSH login can succeed with hardcoded default credentials (if the device is in the uncommissioned state).
Affected products
- Belden Eagle 20 Tofino 943 987-501-Tx/Tx Firmware: all versions
- Belden Eagle 20 Tofino 943 987-502 -Tx/Mm Firmware: all versions
- Belden Eagle 20 Tofino 943 987-504-Mm/Tx Firmware: all versions
- Belden Eagle 20 Tofino 943 987-505-Mm/Mm Firmware: all versions
- Belden Tofino Argon Fa-Tsa-100-Tx/Tx Firmware: all versions
- Belden Tofino Argon Fa-Tsa-220-Mm/Mm Firmware: all versions
- Belden Tofino Argon Fa-Tsa-220-Mm/Tx Firmware: all versions
- Belden Tofino Argon Fa-Tsa-220-Tx/Mm Firmware: all versions
- Belden Tofino Argon Fa-Tsa-220-Tx/Tx Firmware: all versions
- Belden Tofino Xenon Security Appliance Firmware: before 03.2.03 — fixed in 03.2.03
- Schneider-Electric Tcsefea23F3F20 Firmware: all versions
- Schneider-Electric Tcsefea23F3F21 Firmware: all versions
- Schneider-Electric Tcsefea23F3F22 Firmware: before 03.23 — fixed in 03.23
How to fix
Upgrade to a fixed version: Belden Tofino Xenon Security Appliance Firmware 03.2.03; Schneider-Electric Tcsefea23F3F22 Firmware 03.23. Check the vendor advisory for mitigations.
References
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-05
- https://www.belden.com/support/security-assurance
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-05
- https://www.belden.com/support/security-assurance
Get alerted when CVE-2021-30064 or the next vulnerability affects your stack