CyberSec.Space Logo
Back to CVE Browser

CVE-2021-30066

MEDIUM
6.8
CVSS Severity Score
EPSS Score0.1060%
EPSS Percentile15.10th
PublishedApr 3, 2022
Last ModifiedNov 21, 2024

Vulnerability Description

On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, an arbitrary firmware image can be loaded because firmware signature verification (for a USB stick) can be bypassed. NOTE: this issue exists because of an incomplete fix of CVE-2017-11400.

Affected Platforms (CPE)

💻
Belden

Tofino Xenon Security Appliance Firmware

< 03.2.03
💻
Belden

Tofino Argon Fa Tsa 220 Tx\/mm Firmware

All versions
💻
Belden

Tofino Argon Fa Tsa 220 Tx\/tx Firmware

All versions
💻
Belden

Tofino Argon Fa Tsa 220 Mm\/tx Firmware

All versions
💻
Belden

Tofino Argon Fa Tsa 220 Mm\/mm Firmware

All versions
💻
Belden

Tofino Argon Fa Tsa 100 Tx\/tx Firmware

All versions
💻
Belden

Eagle 20 Tofino 943 987 505 Mm\/mm Firmware

All versions
💻
Belden

Eagle 20 Tofino 943 987 504 Mm\/tx Firmware

All versions
💻
Belden

Eagle 20 Tofino 943 987 502 Tx\/mm Firmware

All versions
💻
Belden

Eagle 20 Tofino 943 987 501 Tx\/tx Firmware

All versions
💻
Schneider Electric

Tcsefea23f3f20 Firmware

All versions
💻
Schneider Electric

Tcsefea23f3f21 Firmware

All versions
💻
Schneider Electric

Tcsefea23f3f22 Firmware

< 03.23

References & Advisories

🔗 https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-05
🔗 https://www.belden.com/support/security-assurance
🔗 https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-05
🔗 https://www.belden.com/support/security-assurance

Related Vulnerabilities

CVE-2017-114006.8

An issue has been discovered on the Belden Hirschmann Tofino Xenon Security Appliance before 03.2.00. An incomplete firmware signa...

CVE-2021-4422810.0

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration...

CVE-2021-3267110.0

Flarum is a forum software for building communities. Flarum's translation system allowed for string inputs to be converted into HT...

CVE-2021-2647210.0

In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 installed on Windows, the http API located at /consumerweb/secure/dow...