Skip to main content

Wha Gw F2D2 0 As Z2 Eth Firmware CVE-2021-34565

CRITICAL
Use of Hard-coded Credentials (CWE-798)
2021-08-31 info@cert.vde.com
Authentication Bypass Wha Gw F2D2 0 As Z2 Eth Firmware Wha Gw F2D2 0 As Z2 Eth Eip Firmware
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Aug 31, 2021 - 11:15 nvd
CRITICAL 9.8

DescriptionNVD

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.7 to 3.0.9 the SSH and telnet services are active with hard-coded credentials.

AnalysisAI

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.7 to 3.0.9 the SSH and telnet services are active with hard-coded credentials. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Use of Hard-coded Credentials (CWE-798), which allows attackers to gain access using credentials embedded in source code. In PEPPERL+FUCHS WirelessHART-Gateway 3.0.7 to 3.0.9 the SSH and telnet services are active with hard-coded credentials. Affected products include: Pepperl-Fuchs Wha-Gw-F2D2-0-As-Z2-Eth Firmware, Pepperl-Fuchs Wha-Gw-F2D2-0-As-Z2-Eth.Eip Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Remove hard-coded credentials, use environment variables or secrets management, rotate exposed credentials immediately.

More in Wha Gw F2D2 0 As Z2 Eth Firmware

View all
CVE-2021-34561 HIGH
8.8 Aug 31

In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 serious issue exists, if the application is not externally accessible or

CVE-2021-33555 HIGH
7.5 Aug 31

In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.7 the filename parameter is vulnerable to unauthenticated path traversal at
CVE-2021-34562 MEDIUM
6.1 Aug 31

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 it is possible to inject arbitrary JavaScript into the application's respons
CVE-2021-34564 MEDIUM
5.5 Aug 31

Any cookie-stealing vulnerabilities within the application or browser would enable an attacker to steal the user's crede
CVE-2021-34560 MEDIUM
5.5 Aug 31

In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.9 a form contains a password field with autocomplete enabled. Rated medium

CVE-2021-34559 MEDIUM
5.3 Aug 31

In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 a vulnerability may allow remote attackers to rewrite links and URLs in c
CVE-2021-34563 LOW
3.3 Aug 31

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie. Rated low severity

Same weakness CWE-798 – Use of Hard-coded Credentials

View all
CVE-2016-1560 CRITICAL POC
9.8
CVE-2017-14143 CRITICAL POC
9.8
CVE-2026-22769 CRITICAL
10.0
CVE-2016-5678 CRITICAL POC
9.8
CVE-2017-6558 CRITICAL POC
9.8
CVE-2015-7246 CRITICAL POC
9.8
CVE-2015-4667 CRITICAL POC
9.8
CVE-2016-10177 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2021-34565 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy