Security readout for executives and security teams
Plain-English summary
Phoenix Contact ILC1x industrial controllers can be forced offline at the network communication layer by unauthenticated remote traffic. The automation task reportedly continues, but operators lose network communication until the device is restarted. This is mainly an availability and operational visibility risk for affected industrial environments.
Executive priority
Treat this as a high-priority operational resilience issue where affected PLCs support important production processes. It does not claim loss of automation logic, data theft, or integrity impact, but it can disrupt monitoring and network control until restart.
Technical view
CVE-2021-33541 affects Phoenix Contact Classic Line Controllers ILC1x0 and ILC1x1, all variants. The issue is unauthenticated device access and communication protocols, allowing specially crafted IP packets to stop network communication. CVSS 3.1 is 7.5, network exploitable, low complexity, no privileges or user interaction required, availability impact high.
Likely exposure
Exposure is likely limited to organizations operating Phoenix Contact ILC1x0 or ILC1x1 PLCs reachable over IP networks. Risk rises if controller interfaces are accessible from broader corporate, vendor, or remote-access networks instead of tightly segmented industrial networks.
Exploitation context
The bundle does not indicate active exploitation, and the CVE is not marked KEV. The described attack is remote and unauthenticated, but evidence here does not include exploit availability, observed campaigns, or proof-of-concept status.
Researcher notes
The source bundle attributes the weakness to missing authentication on communication protocols and device access, with CWE-770 listed. The exact packet structure, protocol details, fixed versions, and vendor mitigations are not included in the provided evidence, so validation should remain non-invasive and asset-focused.
Mitigation direction
- Check Phoenix Contact and VDE advisory VDE-2021-019 for current vendor remediation guidance.
- Inventory ILC1x0 and ILC1x1 controllers, including variants and firmware state.
- Restrict controller network reachability to trusted industrial hosts and segments.
- Review restart procedures because network recovery requires restarting the affected device.
- Prioritize monitoring for unexpected loss of PLC network communication.
Validation and detection
- Confirm whether Phoenix Contact Classic Line ILC1x0 or ILC1x1 controllers are deployed.
- Verify untrusted systems cannot reach PLC network interfaces or communication services.
- Review logs or operations records for unexplained network communication loss requiring restart.
- Check whether vendor guidance from VDE-2021-019 has been assessed and applied.
- Document any exposed controllers requiring compensating controls or maintenance windows.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-770: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-33541 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://cert.vde.com/en-us/advisories/vde-2021-019CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.