CVE-2021-34598

mediumpriority · track · 17EPSS 0.009 · 61 %ileDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.93% (61st) EPSS

CVSS 4.3 · medium

Is it mine?

16 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · phoenix_contact_psirt

EPSS · scored 2026-10-28

In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 the remote logging functionality is impaired by the lack of memory release for data structures from syslog-ng when remote logging is active

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedphoenix_contact_psirt
PHOENIX CONTACT recomments to upgrade to firmware version 1.5.1 (or any later version) which fixes both vulnerabitlities. If the Basic settings > LDAP or Logs > Remote logging page are viewed after the upgrade, an exploit that may have been embedded into these pages is no longer effective. It is recommended to review all settings for modifications that an untrusted user may have made by exploiting this vulnerability before the upgrade. It is recommended to mistrust logs (generated before the upgrade) with respect to which user modified any settings.
Mitigationphoenix_contact_psirt
CVE-2021-34582: If an untrusted user may have exploited the vulnerability, it is recommended to revoke access for that user, and to re-upload the certificates on the Basic settings > LDAP and Logs > Remote logging pages through the REST API (i.e., without viewing these pages in the web-based management). CVE-2021-34598: To prevent the possibility of an attack, it is recommended to deactivate remote logging.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.3–7.5

v2.04.3mediumAV:N/AC:M/Au:N/C:N/I:N/A:Pprimary · NVD / NIST USexploitability 8.6 · impact 2.9

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · info@cert.vde.comexploitability 3.9 · impact 3.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · Phoenix Contact PSIRT DE

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-401USCWE-401US

affected products (16)

Products and version ranges known to be affected.

PHOENIX CONTACT FL MGUARD1.4.0 → FL MGUARD 1102 (No. 1153079)*enisa_euvdEU
PHOENIX CONTACT FL MGUARD1.4.0 → FL MGUARD 1105 (No. 1153078)*enisa_euvdEU
phoenixcontact fl mguard 1102 firmware= 1.4.0nvdUScpe:2.3:o:phoenixcontact:fl_mguard_1102_firmware:*:*:*:*:*:*:*:*
phoenixcontact fl mguard 1102 firmware= 1.4.1nvdUScpe:2.3:o:phoenixcontact:fl_mguard_1102_firmware:*:*:*:*:*:*:*:*
phoenixcontact fl mguard 1102 firmware= 1.5.0nvdUScpe:2.3:o:phoenixcontact:fl_mguard_1102_firmware:*:*:*:*:*:*:*:*
phoenixcontact fl mguard 1105 firmware= 1.4.0nvdUScpe:2.3:o:phoenixcontact:fl_mguard_1105_firmware:*:*:*:*:*:*:*:*
phoenixcontact fl mguard 1105 firmware= 1.4.1nvdUScpe:2.3:o:phoenixcontact:fl_mguard_1105_firmware:*:*:*:*:*:*:*:*
phoenixcontact fl mguard 1105 firmware= 1.5.0nvdUScpe:2.3:o:phoenixcontact:fl_mguard_1105_firmware:*:*:*:*:*:*:*:*
Firmware 1.4.0 installed on FL MGUARD 1102all versionsphoenix_contact_psirtDE
Firmware 1.4.0 installed on FL MGUARD 1105all versionsphoenix_contact_psirtDE
Firmware 1.4.1 installed on FL MGUARD 1102all versionsphoenix_contact_psirtDE
Firmware 1.4.1 installed on FL MGUARD 1105all versionsphoenix_contact_psirtDE
Firmware 1.5.0 installed on FL MGUARD 1102all versionsphoenix_contact_psirtDE
Firmware 1.5.0 installed on FL MGUARD 1105all versionsphoenix_contact_psirtDE
Firmware 1.5.1 installed on FL MGUARD 1102all versionsfixedphoenix_contact_psirtDE
Firmware 1.5.1 installed on FL MGUARD 1105all versionsfixedphoenix_contact_psirtDE

advisories (1)

Vendor and ecosystem advisories describing this.

VDE-2021-046PHOENIX CONTACT: XSS and memory-leak in FL MGUARD 1102/11052021-11-10csaf · phoenix_contact_psirtDE
Cross-site scripting in web-based management and memory leak in the remote logging function of FL MGUARD 1102 and FL MGUARD 1105. CVE-2021-34582: The file upload functionality in the web-based management is affected by a stored cross-site scripting vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation). An authenticated FL MGUARD user with Admin or Super Admin role can upload a certificate file on the Basic settings > LDAP page, on the Logs > Remote logging page, or through the REST API. The content of this file is embedded into the corresponding web page, and any HTML code within the file is rendered when the page is viewed by the same or a different authenticated user. CVE-2021-34598: The remote logging functionality is impaired by the lack of memory release for data structures from syslog-ng when remote logging is active (CWE-770: Allocation of Resources Without Limits or Throttling).

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd phoenix_contact_psirt NVD CVE.org MITRE

published 2021-11-10modified 2026-06-17

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan