CVE-2021-34579 - CVE House
Back to Database
Status published High CVE-2021-34579

PHOENIX CONTACT: FL MGUARD DM version 1.12.0 and 1.13.0 Improper Privilege Management

Vulnerability Description

In Phoenix Contact: FL MGUARD DM version 1.12.0 and 1.13.0 access to the Apache web server being installed as part of the FL MGUARD DM on Microsoft Windows does not require login credentials even if configured during installation.Attackers with network access to the Apache web server can download and therefore read mGuard configuration profiles (“ATV profiles”). Such configuration profiles may contain sensitive information, e.g. private keys associated with IPsec VPN connections.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-34579

Credits & Attribution

No credits recorded in the NVD database.

References

More from PHOENIX CONTACT

View All →
CVE-2025-41668
Phoenix Contact: File access due to the replacement of a critical file used by the service security-profile
High 8.8
CVE-2025-41667
Phoenix Contact: File access due to the replacement of a critical file used by the arp-preinit script
High 8.8
CVE-2025-41666
Phoenix Contact: File access due to the replacement of a critical file used by the watchdog
High 8.8
CVE-2025-41665
Phoenix Contact: DoS of the PLC due to incorrect default permissions possible
Medium 6.5
CVE-2024-7734
Phoenix Contact: Multiple mGuard devices are vulnerable to a drain of open file descriptors.
Medium 5.3

Affected Vendor

PHOENIX CONTACT

View all reports →

Affected Software

FL MGUARD DM (2981974)
Vulnerable Versions:
1.12.0, 1.13.0

Timeline

Official Publish: November 9th, 2022
Last Modified: April 29th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-269

MITRE ATT&CK TTPs

T1078 Valid Accounts
Persistence
T1098 Account Manipulation
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1222 File and Directory Permissions Modification
Defense Evasion
T1134 Access Token Manipulation
Defense Evasion