CVE-2021-30064
moderate-risk
Published 2022-04-03
On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, an SSH login can succeed with hardcoded default credentials (if the device is in the uncommissioned state).
Do I need to act?
-
0.06% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10
Critical
NETWORK
/ LOW complexity
Affected Products (13)
Tofino Xenon Security Appliance Firmware
Tofino Argon Fa-Tsa-220-Tx\/Mm Firmware
Tofino Argon Fa-Tsa-220-Tx\/Tx Firmware
Tofino Argon Fa-Tsa-220-Mm\/Tx Firmware
Tofino Argon Fa-Tsa-220-Mm\/Mm Firmware
Tofino Argon Fa-Tsa-100-Tx\/Tx Firmware
Eagle 20 Tofino 943 987-505-Mm\/Mm Firmware
Eagle 20 Tofino 943 987-504-Mm\/Tx Firmware
Eagle 20 Tofino 943 987-502 -Tx\/Mm Firmware
Eagle 20 Tofino 943 987-501-Tx\/Tx Firmware
Tcsefea23F3F20 Firmware
Tcsefea23F3F21 Firmware
Tcsefea23F3F22 Firmware
Affected Vendors
References (4)
Vendor Advisory
https://www.belden.com/support/security-assurance
Vendor Advisory
https://www.belden.com/support/security-assurance
49
/ 100
moderate-risk
Severity
32/34 · Critical
Exploitability
0/34 · Minimal
Exposure
17/34 · Moderate