Skip to main content

Wha Gw F2D2 0 As Z2 Eth Firmware CVE-2021-34563

LOW
Sensitive Cookie Without 'HttpOnly' Flag (CWE-1004)
2021-08-31 info@cert.vde.com
Information Disclosure Wha Gw F2D2 0 As Z2 Eth Firmware Wha Gw F2D2 0 As Z2 Eth Eip Firmware
3.3
CVSS 3.1 · NVD

Severity by source

NVD PRIMARY
3.3 LOW
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Aug 31, 2021 - 11:15 nvd
LOW 3.3

DescriptionNVD

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie. This allows the cookie's value to be read or set by client-side JavaScript.

AnalysisAI

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-1004. In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie. This allows the cookie's value to be read or set by client-side JavaScript. Affected products include: Pepperl-Fuchs Wha-Gw-F2D2-0-As-Z2-Eth Firmware, Pepperl-Fuchs Wha-Gw-F2D2-0-As-Z2-Eth.Eip Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Wha Gw F2D2 0 As Z2 Eth Firmware

View all
CVE-2021-34565 CRITICAL
9.8 Aug 31

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.7 to 3.0.9 the SSH and telnet services are active with hard-coded credentials.
CVE-2021-34561 HIGH
8.8 Aug 31

In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 serious issue exists, if the application is not externally accessible or

CVE-2021-33555 HIGH
7.5 Aug 31

In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.7 the filename parameter is vulnerable to unauthenticated path traversal at
CVE-2021-34562 MEDIUM
6.1 Aug 31

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 it is possible to inject arbitrary JavaScript into the application's respons
CVE-2021-34564 MEDIUM
5.5 Aug 31

Any cookie-stealing vulnerabilities within the application or browser would enable an attacker to steal the user's crede
CVE-2021-34560 MEDIUM
5.5 Aug 31

In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.9 a form contains a password field with autocomplete enabled. Rated medium

CVE-2021-34559 MEDIUM
5.3 Aug 31

In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 a vulnerability may allow remote attackers to rewrite links and URLs in c

Same weakness CWE-1004 – Sensitive Cookie Without 'HttpOnly' Flag

View all
CVE-2021-3706 HIGH POC
7.5
CVE-2024-6739 MEDIUM POC
6.1
CVE-2022-25172 MEDIUM POC
6.1
CVE-2020-27658 MEDIUM POC
6.1
CVE-2025-26844 CRITICAL
9.8
CVE-2022-4630 MEDIUM POC
5.3
CVE-2021-42115 CRITICAL
9.1
CVE-2026-42239 HIGH
8.1

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2021-34563 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy