CVE-2021-33541

Phoenix Contact: ILC1x Industrial controllers affected by Denial-of-Service vulnerability

State: Published
Severity: 7.5 High
Published: Jun 25, 2021
Updated: Sep 16, 2024
Reserved: May 24, 2021

Description

Phoenix Contact Classic Line Controllers ILC1x0 and ILC1x1 in all versions/variants are affected by a Denial-of-Service vulnerability. The communication protocols and device access do not feature authentication measures. Remote attackers can use specially crafted IP packets to cause a denial of service on the PLC's network communication module. A successful attack stops all network communication. To restore the network connectivity the device needs to be restarted. The automation task is not affected.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	CERTVDE

Weaknesses

CWE-770 Allocation of Resources Without Limits or Throttling

Affected Products

Product	Versions
ILC1xPhoenix Contact	ILC1x0 all variantsAffected ILC1x1 all variantsAffected

References

https://cert.vde.com/en-us/advisories/vde-2021-019

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.