6.5

CVE-2020-12521

On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS a specially crafted LLDP packet may lead to a high system load in the PROFINET stack. An attacker can cause failure of system services or a complete reboot.

Data is provided by the National Vulnerability Database (NVD)
Phoenixcontact ≫ Plcnext Firmware SwEditionlong_term_support Version < 2021.0
   Phoenixcontact ≫ Axc F 1152 Version-
Phoenixcontact ≫ Plcnext Firmware SwEditionlong_term_support Version < 2021.0
   Phoenixcontact ≫ Axc F 2152 Version-
Phoenixcontact ≫ Plcnext Firmware SwEditionlong_term_support Version < 2021.0
   Phoenixcontact ≫ Axc F 3152 Version-
Phoenixcontact ≫ Plcnext Firmware SwEditionlong_term_support Version < 2021.0
   Phoenixcontact ≫ Rfc 4072s Version-
Phoenixcontact ≫ Plcnext Firmware SwEditionlong_term_support Version < 2021.0
Phoenixcontact ≫ Plcnext Firmware SwEditionlong_term_support Version < 2021.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.08% 0.217
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 6.1 6.5 6.9
AV:A/AC:L/Au:N/C:N/I:N/A:C
info@cert.vde.com 6.5 2.8 3.6
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.