CVE-2021-21003

mediumpriority · track · 21EPSS 0.009 · 61 %ileDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.95% (61st) EPSS

CVSS 5 · medium

Is it mine?

45 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · phoenix_contact_psirt

EPSS · scored 2026-10-27

In Phoenix Contact FL SWITCH SMCS series products in multiple versions fragmented TCP-Packets may cause a Denial of Service of Web-, SNMP- and ICMP-Echo services. The switching functionality of the device is not affected.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

No vendor fix yet; a mitigation is available.

Mitigationphoenix_contact_psirt
Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note: Measures to protect network-capable devices with Ethernet connection

cvss

Technical severity, 0–10. One row per scoring source.

5.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.05mediumAV:N/AC:L/Au:N/C:N/I:N/A:Pprimary · NVD / NIST USexploitability 10 · impact 2.9

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lprimary · NVD / NIST USexploitability 3.9 · impact 1.4

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · ENISA EU

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · info@cert.vde.comexploitability 3.9 · impact 1.4

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · Phoenix Contact PSIRT DE

v3.14.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-404USCWE-404US

affected products (45)

Products and version ranges known to be affected.

PHOENIX CONTACT FL NAT≤ SMN 8TX (2989365) ≤4.63enisa_euvdEU
PHOENIX CONTACT FL NAT≤ SMN 8TX-M (2702443) ≤4.63enisa_euvdEU
PHOENIX CONTACT FL SWITCH≤ SMCS 4TX-PN (2989093) ≤4.70enisa_euvdEU
PHOENIX CONTACT FL SWITCH≤ SMCS 14TX/2FX (2700997) ≤4.70enisa_euvdEU
PHOENIX CONTACT FL SWITCH≤ SMN 6TX/2FX (2989543) ≤4.70enisa_euvdEU
PHOENIX CONTACT FL SWITCH≤ SMCS 16TX (2700996) ≤4.70enisa_euvdEU
PHOENIX CONTACT FL SWITCH≤ SMN 6TX/2POF-PN (2700290) ≤4.70enisa_euvdEU
PHOENIX CONTACT FL SWITCH≤ SMN 8TX-PN (2989501) ≤4.70enisa_euvdEU
PHOENIX CONTACT FL SWITCH≤ SMCS 8GT (2891123) ≤4.70enisa_euvdEU
PHOENIX CONTACT FL SWITCH≤ SMCS 6TX/2SFP (2989323) ≤4.70enisa_euvdEU
PHOENIX CONTACT FL SWITCH≤ SMCS 6GT/2SFP (2891479) ≤4.70enisa_euvdEU
PHOENIX CONTACT FL SWITCH≤ SMCS 8TX-PN (2989103) ≤4.70enisa_euvdEU
PHOENIX CONTACT FL SWITCH≤ SMCS 14TX/2FX-SM (2701466) ≤4.70enisa_euvdEU
PHOENIX CONTACT FL SWITCH≤ SMCS 8TX (2989226) ≤4.70enisa_euvdEU
PHOENIX CONTACT FL SWITCH≤ SMN 6TX/2FX SM (2989556) ≤4.70enisa_euvdEU
phoenixcontact fl nat smn 8tx firmware≤ 4.63nvdUScpe:2.3:o:phoenixcontact:fl_nat_smn_8tx_firmware:*:*:*:*:*:*:*:*
phoenixcontact fl nat smn 8tx-m firmware≤ 4.63nvdUScpe:2.3:o:phoenixcontact:fl_nat_smn_8tx-m_firmware:*:*:*:*:*:*:*:*
phoenixcontact fl switch smcs 14tx/2fx firmware≤ 4.70nvdUScpe:2.3:o:phoenixcontact:fl_switch_smcs_14tx\/2fx_firmware:*:*:*:*:*:*:*:*
phoenixcontact fl switch smcs 14tx/2fx-sm firmware≤ 4.70nvdUScpe:2.3:o:phoenixcontact:fl_switch_smcs_14tx\/2fx-sm_firmware:*:*:*:*:*:*:*:*
phoenixcontact fl switch smcs 16tx firmware≤ 4.70nvdUScpe:2.3:o:phoenixcontact:fl_switch_smcs_16tx_firmware:*:*:*:*:*:*:*:*

showing 20 of 45

advisories (1)

Vendor and ecosystem advisories describing this.

VDE-2021-023PHOENIX CONTACT: Security Advisory for FL SWITCH SMCS series2021-06-23csaf · phoenix_contact_psirtDE
Multiple vulnerabilities have been discovered in the current firmware of the PHOENIX CONTACT FL SWITCH SMCS series switches.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd phoenix_contact_psirt NVD CVE.org MITRE

published 2021-06-25modified 2026-06-17

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan