What is the CVSS score of CVE-2021-33540?

CVE-2021-33540 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.7%.

Axl F Bk Pn Tps Xc Firmware CVE-2021-33540

HIGH

Use of Hard-coded Credentials (CWE-798)

2021-06-25 info@cert.vde.com

Authentication Bypass Axl F Bk Pn Tps Xc Firmware Axl F Bk Pn Tps Firmware Axl F Bk Eip Firmware Axl F Bk Eip Ef Firmware Axl F Bk Eth Firmware Axl F Bk Eth Xc Firmware Axl F Bk S35 Firmware Axl F Bk Pn Firmware Axl F Bk Pn Xc Firmware Axl F Bk Eth Net2 Firmware Axl F Bk Sas Firmware Il Pn Bk Pac Firmware Il Pn Bk Di8 Do4 2Tx Pac Firmware Il Pn Bk Di8 Do4 2Scrj Pac Firmware Il Eth Bk Di8 Do4 2Tx Xc Pac Firmware Il Eth Bk Di8 Do4 2Tx Pac Firmware Il Eip Bk Di8 Do4 2Tx Pac Firmware Il S3 Bk Di8 Do4 2Tx Pac Firmware

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

CVE Published

Jun 25, 2021 - 19:15 nvd

HIGH 7.3

DescriptionNVD

In certain devices of the Phoenix Contact AXL F BK and IL BK product families an undocumented password protected FTP access to the root directory exists.

AnalysisAI

In certain devices of the Phoenix Contact AXL F BK and IL BK product families an undocumented password protected FTP access to the root directory exists. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Use of Hard-coded Credentials (CWE-798), which allows attackers to gain access using credentials embedded in source code. In certain devices of the Phoenix Contact AXL F BK and IL BK product families an undocumented password protected FTP access to the root directory exists. Affected products include: Phoenixcontact Axl F Bk Pn Tps Xc Firmware, Phoenixcontact Axl F Bk Pn Tps Firmware, Phoenixcontact Axl F Bk Eip Firmware, Phoenixcontact Axl F Bk Eip Ef Firmware, Phoenixcontact Axl F Bk Eth Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Remove hard-coded credentials, use environment variables or secrets management, rotate exposed credentials immediately.