Skip to main content

Wha Gw F2D2 0 As Z2 Eth Firmware CVE-2021-34559

MEDIUM
HTTP Request/Response Smuggling (CWE-444)
2021-08-31 info@cert.vde.com
Request Smuggling Information Disclosure Wha Gw F2D2 0 As Z2 Eth Firmware Wha Gw F2D2 0 As Z2 Eth Eip Firmware
5.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

1
CVE Published
Aug 31, 2021 - 11:15 nvd
MEDIUM 5.3

DescriptionNVD

In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 a vulnerability may allow remote attackers to rewrite links and URLs in cached pages to arbitrary strings.

AnalysisAI

In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 a vulnerability may allow remote attackers to rewrite links and URLs in cached pages to arbitrary strings. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as HTTP Request/Response Smuggling (CWE-444), which allows attackers to manipulate HTTP request interpretation between frontend and backend servers. In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 a vulnerability may allow remote attackers to rewrite links and URLs in cached pages to arbitrary strings. Affected products include: Pepperl-Fuchs Wha-Gw-F2D2-0-As-Z2-Eth Firmware, Pepperl-Fuchs Wha-Gw-F2D2-0-As-Z2-Eth.Eip Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Enforce strict HTTP parsing, normalize requests at proxy layer, use HTTP/2 end-to-end, reject ambiguous headers.

More in Wha Gw F2D2 0 As Z2 Eth Firmware

View all
CVE-2021-34565 CRITICAL
9.8 Aug 31

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.7 to 3.0.9 the SSH and telnet services are active with hard-coded credentials.
CVE-2021-34561 HIGH
8.8 Aug 31

In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 serious issue exists, if the application is not externally accessible or

CVE-2021-33555 HIGH
7.5 Aug 31

In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.7 the filename parameter is vulnerable to unauthenticated path traversal at
CVE-2021-34562 MEDIUM
6.1 Aug 31

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 it is possible to inject arbitrary JavaScript into the application's respons
CVE-2021-34564 MEDIUM
5.5 Aug 31

Any cookie-stealing vulnerabilities within the application or browser would enable an attacker to steal the user's crede
CVE-2021-34560 MEDIUM
5.5 Aug 31

In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.9 a form contains a password field with autocomplete enabled. Rated medium

CVE-2021-34563 LOW
3.3 Aug 31

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie. Rated low severity

Same weakness CWE-444 – HTTP Request/Response Smuggling

View all
CVE-2018-3907 CRITICAL POC
10.0
CVE-2023-41265 CRITICAL POC
9.9
CVE-2024-10264 CRITICAL POC
9.8
CVE-2022-2466 CRITICAL POC
9.8
CVE-2020-7611 CRITICAL POC
9.8
CVE-2020-10109 CRITICAL POC
9.8
CVE-2020-10108 CRITICAL POC
9.8
CVE-2021-38162 CRITICAL POC
9.4

Same technique Request Smuggling

View all
CVE-2018-3907 CRITICAL POC
10.0
CVE-2023-41265 CRITICAL POC
9.9
CVE-2024-10264 CRITICAL POC
9.8
CVE-2022-2466 CRITICAL POC
9.8
CVE-2020-7611 CRITICAL POC
9.8
CVE-2020-10109 CRITICAL POC
9.8
CVE-2020-10108 CRITICAL POC
9.8
CVE-2021-38162 CRITICAL POC
9.4

Share

CVE-2021-34559 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy