Security readout for executives and security teams
Plain-English summary
Some Phoenix Contact industrial switches and FL NAT products can place attacker-controlled LLDP data into the web management interface. If an administrator later views the affected management page, script code could run in that browser session. This is mainly an OT/local-network risk, not evidence of broad internet exploitation.
Executive priority
Treat this as a high-priority OT network hardening item where affected Phoenix Contact devices are deployed. It is not described as actively exploited, but it can affect administrator browser sessions and management integrity inside industrial environments.
Technical view
CVE-2021-21004 is a CWE-79 cross-site scripting flaw in listed Phoenix Contact FL SWITCH SMCS/SMN and FL NAT SMN products. The CVSS 3.1 score is 7.4: adjacent network attack vector, low complexity, no privileges, user interaction required, changed scope, low confidentiality impact, high integrity impact, and no availability impact.
Likely exposure
Exposure is most likely in industrial networks using the named Phoenix Contact switch and NAT models, especially where LLDP is accepted from less-trusted adjacent network segments and administrators use the web-based management interface.
Exploitation context
The provided sources do not show CISA KEV listing or active exploitation. Exploitation requires adjacent network access to inject LLDP data and a client interaction with the web management interface. Impact is browser-side code execution in that management context, with integrity risk emphasized by CVSS.
Researcher notes
The key technical condition is untrusted LLDP data reaching web-based management rendering. The bundle does not provide fixed-version details, exploit maturity, or device configuration specifics. Avoid assuming broader Phoenix Contact product impact beyond the listed models.
Mitigation direction
- Inventory the listed Phoenix Contact FL SWITCH and FL NAT model numbers.
- Check Phoenix Contact or VDE guidance for fixed firmware or supported mitigations.
- Restrict web management access to trusted administrative networks only.
- Limit LLDP exposure on untrusted links where operationally acceptable.
- Use network segmentation around OT management workstations and switch management interfaces.
Validation and detection
- Match deployed devices against the affected model and part-number list.
- Record firmware versions and compare them with vendor advisory guidance.
- Verify web management is not reachable from user or guest networks.
- Review LLDP use on adjacent segments connected to these devices.
- Confirm remediation status through vendor documentation, not assumptions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-21004 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N2.14.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.4HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://cert.vde.com/en-us/advisories/vde-2021-023CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.