CVE-2021-34579

PHOENIX CONTACT: FL MGUARD DM version 1.12.0 and 1.13.0 Improper Privilege Management

State: Published
Severity: 7.5 High
Published: Nov 9, 2022
Updated: Apr 29, 2025
Reserved: Jun 10, 2021

Description

In Phoenix Contact: FL MGUARD DM version 1.12.0 and 1.13.0 access to the Apache web server being installed as part of the FL MGUARD DM on Microsoft Windows does not require login credentials even if configured during installation.Attackers with network access to the Apache web server can download and therefore read mGuard configuration profiles (“ATV profiles”). Such configuration profiles may contain sensitive information, e.g. private keys associated with IPsec VPN connections.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	CERTVDE

Weaknesses

CWE-269 Improper Privilege Management

Affected Products

Product	Versions
FL MGUARD DM (2981974)PHOENIX CONTACT	1.12.0Affected 1.13.0Affected

References

https://cert.vde.com/en/advisories/VDE-2021-035/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.