CVE-2021-23017

mediumPriorität · beachten · 60EPSS 0.535 · 99. PerzentilExploit · PoCDEEURUUS
grimoire priorityP1 · Urgent
Exploitable?
Public exploit
10 exploits · PoC
Likely / severe?
53.5% (99th) EPSS
CVSS 6.8 · medium
Is it mine?
97 products
Prüfe deine Angriffsfläche
Who says so?
7 sources
cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-27

A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • Behobenphoenix_contact_psirt

    **Update to Firmware Release 2022.0.3 LTS or higher:** - AXC F 2152 (2404267) [Download](http://www.phoenixcontact.net/qr/2404267/firmware) - AXC F 1152 (1151412) [Download](http://www.phoenixcontact.net/qr/1151412/firmware) - AXC F 3152 (1069208) Not yet released **Update to PLCnext Engineer Release 2022.0.1 LTS or higher.**

  • Mitigationphoenix_contact_psirt

    Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note: Measures to protect network-capable devices with Ethernet connection

  • WorkaroundSICK TDC-E210GC all Firmware versionssick_psirt

    Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk. The collected resources "SICK Operating Guidelines" and "ICS-CERT recommended practices on Industrial Security" could help to implement the general security practices.

  • WorkaroundEndress+Hauser SSG-E210GC all Firmware versionssick_psirt

    Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk. The collected resources "SICK Operating Guidelines" and "ICS-CERT recommended practices on Industrial Security" could help to implement the general security practices.

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.7
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.8–7.7

v2.06.8mediumAV:N/AC:M/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USAusnutzbarkeit 8.6 · Auswirkung 6.4
v3.17.7highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Lprimary · NVD / NIST USAusnutzbarkeit 2.2 · Auswirkung 5.5
v3.17.7highAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Lsecondary · FSTEC (BDU) RU
v3.17.7highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Lsecondary · Phoenix Contact PSIRT DE
v3.17.7highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Lsecondary · SICK PSIRT DE
v3.17.7highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L/E:Hsecondary · CVSS-BT (t0sche)
03

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-193USprimärCWE-193USCWE-193USCWE-193US
04

Exploits (10)

Öffentlicher Proof-of-Concept- und Exploit-Code.

05

betroffene Produkte (97)

Betroffene Produkte und Versionsbereiche.

20 von 97 angezeigt
06

Advisories (7)

Hersteller- und Ökosystem-Meldungen dazu.

  • SCA-2025-0009Vulnerabilities affecting SICK TDC-E210GC2025-08-01csaf · sick_psirtDE

    SICK has identified multiple vulnerabilities in the SICK TDC-E210GC product. The advisory includes a total of 23 vulnerabilities, of which 14 are confirmed as affected and 9 as known not affected. At this time, SICK is not aware of any public exploits specifically targeting these vulnerabilities. Customers are strongly advised to apply the recommended workaround for the affected vulnerabilities to reduce potential risk.

  • SCA-2025-0011Vulnerabilities affecting Endress+Hauser SSG-E210GC2025-10-02csaf · sick_psirtDE

    Several vulnerabilities in the Endress+Hauser SSG-E210GC product were discoverd. The advisory includes a total of 23 vulnerabilities, of which 14 are confirmed as affected and 9 as known not affected.

  • VDE-2022-010PHOENIX CONTACT: Multiple Linux component vulnerabilities fixed in latest AXC F x152 LTS release2022-04-12csaf · phoenix_contact_psirtDE

    PLCnext Control AXC F x152 is certified according to IEC 62443-4-1 and IEC 62443-4-2. This certification requires that all third-party components used in the firmware are regularly checked for known vulnerabilities. Firmware components in version 2021.06 had already been updated. For the 2022.0 LTS version more firmware components have been updated implicitly fixing the vulnerabilities listed. The vulnerabilities listed above have not been individually verified in terms of actual impact and/or limitations in combination with the affected products listed. The current LTS release 2022.0 LTS contains updates of integrated third-party libraries, SDKs and other third-party software to address these issues nevertheless. UPDATE A (April 4th, 2022): Added RFC 4072 (Art. No. 1051328) and fixed affected version of AXC F 3152

  • WID-SEC-W-2022-0463NGINX: Schwachstelle ermöglicht Denial of ServiceDeutsch2021-05-25csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in NGINX ausnutzen, um einen Denial of Service Angriff durchzuführen.

  • WID-SEC-W-2022-0676Juniper Junos Space: Mehrere SchwachstellenDeutsch2022-07-13csaf · cert_bundDE

    Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Juniper Junos Space ausnutzen, um einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder zu verändern, seine Privilegien zu erweitern und Sicherheitsmaßnahmen zu umgehen.

  • BIT-nginx-2021-230172024-03-06vendor · osvUS

    A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.

  • BIT-nginx-gateway-2021-230172025-12-03vendor · osvUS

    A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.

07

auch bekannt als (6)

Weitere Namen und Kennungen dieser Entität.

08

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdfstec_bduosvcert_bundsick_psirtphoenix_contact_psirtNVDCVE.orgMITRE
veröffentlicht 2021-06-01geändert 2026-06-17
10

Referenzen (85)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan