CVE-2021-30061 HIGH

Published: 2022-04-03 | Last Modified: 2024-11-21 | Status: Modified

Description

On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, physically proximate attackers can execute code via a crafted file on a USB stick.

Additional Descriptions (1)

En Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 versiones anteriores a 03.23, TCSEFEA23F3F20/21, y Belden Tofino Xenon Security Appliance, los atacantes físicamente próximos pueden ejecutar código por medio de un archivo diseñado en una memoria USB

CVSS Metrics

Base Score: 6.8 (MEDIUM)

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector	PHYSICAL
Attack Complexity	LOW
Privileges Required	NONE
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	HIGH
Integrity Impact	HIGH
Availability Impact	HIGH

Source: [email protected]

Type: Primary

Exploitability Score: 0.9

Impact Score: 5.9

Base Score: 7.2 (HIGH)

AV:L/AC:L/Au:N/C:C/I:C/A:C

Access Vector	LOCAL
Access Complexity	LOW
Authentication	NONE
Confidentiality Impact	COMPLETE
Integrity Impact	COMPLETE
Availability Impact	COMPLETE

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 10.0

Weaknesses

Source	Type	Description
[email protected]	Primary	en NVD-CWE-noinfo

Affected Products

Vendor	Product	Version	Update	Type
belden	tofino_xenon_security_appliance_firmware	*	<built-in method update of dict object at 0x7e60ba2a4a40>	Operating System
belden	tofino_argon_fa-tsa-220-tx\/mm_firmware	-	<built-in method update of dict object at 0x7e60e884fa00>	Operating System
belden	tofino_argon_fa-tsa-220-tx\/tx_firmware	-	<built-in method update of dict object at 0x7e60ba2a4c40>	Operating System
belden	tofino_argon_fa-tsa-220-mm\/tx_firmware	-	<built-in method update of dict object at 0x7e60b9fb7200>	Operating System
belden	tofino_argon_fa-tsa-220-mm\/mm_firmware	-	<built-in method update of dict object at 0x7e60a8be4e80>	Operating System
belden	tofino_argon_fa-tsa-100-tx\/tx_firmware	-	<built-in method update of dict object at 0x7e60a8be7300>	Operating System
belden	eagle_20_tofino_943_987-505-mm\/mm_firmware	-	<built-in method update of dict object at 0x7e60e884fdc0>	Operating System
belden	eagle_20_tofino_943_987-504-mm\/tx_firmware	-	<built-in method update of dict object at 0x7e60a8be6140>	Operating System
belden	eagle_20_tofino_943_987-502_-tx\/mm_firmware	-	<built-in method update of dict object at 0x7e60e884c140>	Operating System
belden	eagle_20_tofino_943_987-501-tx\/tx_firmware	-	<built-in method update of dict object at 0x7e60a8be6980>	Operating System
schneider-electric	tcsefea23f3f20_firmware	-	<built-in method update of dict object at 0x7e60b9fb7600>	Operating System
schneider-electric	tcsefea23f3f21_firmware	-	<built-in method update of dict object at 0x7e60e884f6c0>	Operating System
schneider-electric	tcsefea23f3f22_firmware	*	<built-in method update of dict object at 0x7e611232c700>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:belden:tofino_xenon_security_appliance_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:belden:tofino_xenon_security_appliance:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:belden:tofino_argon_fa-tsa-220-tx\/mm_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:belden:tofino_argon_fa-tsa-220-tx\/mm:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:belden:tofino_argon_fa-tsa-220-tx\/tx_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:belden:tofino_argon_fa-tsa-220-tx\/tx:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:belden:tofino_argon_fa-tsa-220-mm\/tx_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:belden:tofino_argon_fa-tsa-220-mm\/tx:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:belden:tofino_argon_fa-tsa-220-mm\/mm_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:belden:tofino_argon_fa-tsa-220-mm\/mm:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:belden:tofino_argon_fa-tsa-100-tx\/tx_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:belden:tofino_argon_fa-tsa-100-tx\/tx:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:belden:eagle_20_tofino_943_987-505-mm\/mm_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:belden:eagle_20_tofino_943_987-505-mm\/mm:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:belden:eagle_20_tofino_943_987-504-mm\/tx_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:belden:eagle_20_tofino_943_987-504-mm\/tx:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:belden:eagle_20_tofino_943_987-502_-tx\/mm_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:belden:eagle_20_tofino_943_987-502_-tx\/mm:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:belden:eagle_20_tofino_943_987-501-tx\/tx_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:belden:eagle_20_tofino_943_987-501-tx\/tx:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:tcsefea23f3f20_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:tcsefea23f3f20:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:tcsefea23f3f21_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:tcsefea23f3f21:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:tcsefea23f3f22_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:tcsefea23f3f22:-:::::::*`

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-05
Source: [email protected]

Vendor Advisory
https://www.belden.com/support/security-assurance
Source: [email protected]

Vendor Advisory
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-05
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory
https://www.belden.com/support/security-assurance
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory