CVE-2021-21002
📋 TL;DR
This vulnerability affects Phoenix Contact FL COMSERVER UNI devices running firmware versions below 2.40. An attacker can send specially crafted invalid Modbus exception responses to cause a temporary denial of service, disrupting industrial communication. This impacts organizations using these industrial communication servers in operational technology environments.
💻 Affected Systems
- Phoenix Contact FL COMSERVER UNI
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Critical industrial processes could be disrupted due to communication failure between PLCs and SCADA systems, potentially causing production downtime or safety issues.
Likely Case
Temporary disruption of Modbus communications between industrial devices, requiring manual restart of affected communication servers.
If Mitigated
Minimal impact with proper network segmentation and monitoring; affected devices automatically recover after temporary disruption.
🎯 Exploit Status
Exploitation requires sending malformed Modbus exception packets to the device. No authentication needed if network access is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.40
Vendor Advisory: https://cert.vde.com/en-us/advisories/vde-2021-022
Restart Required: Yes
Instructions:
1. Download firmware version 2.40 from Phoenix Contact support portal. 2. Backup current configuration. 3. Upload new firmware via web interface or configuration tool. 4. Restart device. 5. Verify firmware version shows 2.40.
🔧 Temporary Workarounds
Network Segmentation
allIsolate FL COMSERVER UNI devices in dedicated industrial network segments with strict firewall rules.
Access Control Lists
allImplement network ACLs to restrict which devices can communicate with the COMSERVER on Modbus ports (typically TCP 502).
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected devices from untrusted networks
- Deploy intrusion detection systems to monitor for malformed Modbus traffic patterns
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface (http://device-ip) or configuration tool. If version is below 2.40, device is vulnerable.Check Version:
Connect to device web interface at http://[device-ip] and navigate to System Information pageVerify Fix Applied:
After updating, verify firmware version shows 2.40 in web interface or configuration tool.📡 Detection & Monitoring
Log Indicators:
- Device restart logs
- Communication failure events in industrial system logs
Network Indicators:
- Unusual Modbus exception response patterns
- Multiple malformed Modbus packets from single source
SIEM Query:
source="industrial_network" AND (protocol="modbus" AND (exception_code="invalid" OR packet_size="abnormal"))