What’s Vulnerable › Vulnerabilities

CVE-2021-34570: Phoenix Contact: DoS for PLCnext Control devices in versions prior to 2021.0.5 LTS

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-09-27 · updated 2026-06-17
• Weakness: CWE-20

Description

Multiple Phoenix Contact PLCnext control devices in versions prior to 2021.0.5 LTS are prone to a DoS attack through special crafted JSON requests.

Affected products

• Phoenixcontact Axc F 1152 Firmware: before 2021.0.5 — fixed in 2021.0.5
• Phoenixcontact Axc F 2152 Firmware: before 2021.0.5 — fixed in 2021.0.5
• Phoenixcontact Axc F 2152 Starterkit Firmware: before 2021.0.5 — fixed in 2021.0.5
• Phoenixcontact Axc F 3152 Firmware: before 2021.0.5 — fixed in 2021.0.5
• Phoenixcontact Plcnext Technology Starterkit Firmware: before 2021.0.5 — fixed in 2021.0.5
• Phoenixcontact Rfc 4072S Firmware: before 2021.0.5 — fixed in 2021.0.5

How to fix

Upgrade to a fixed version: Phoenixcontact Axc F 1152 Firmware 2021.0.5; Phoenixcontact Axc F 2152 Firmware 2021.0.5; Phoenixcontact Axc F 2152 Starterkit Firmware 2021.0.5; Phoenixcontact Axc F 3152 Firmware 2021.0.5; Phoenixcontact Plcnext Technology Starterkit Firmware 2021.0.5; Phoenixcontact Rfc 4072S Firmware 2021.0.5. Check the vendor advisory for mitigations.

References

• https://cert.vde.com/en/advisories/VDE-2021-029/
• https://cert.vde.com/en/advisories/VDE-2021-029/

Get alerted when CVE-2021-34570 or the next vulnerability affects your stack