title: A vulnerability in WirelessHART-Gateway <= 3.0.9 could lead to information exposure of sensitive information
description: In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.9 a form contains a password field with autocomplete enabled. The stored credentials can be captured by an attacker who gains control over the user's computer. Therefore the user must have logged in at least once.
problem types: CWE-522 Insufficiently Protected Credentials
affected:
{
product: WHA-GW-F2D2-0-AS- Z2-ETH
vendor: Phoenix Contact
versions:
lessThanOrEqual: 3.0.9, status: affected, version: 3.0.9, versionType: custom
}
{
product: WHA-GW-F2D2-0-AS- Z2-ETH.EIP
vendor: Phoenix Contact
versions:
lessThanOrEqual: 3.0.9, status: affected, version: 3.0.9, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
]
solutions: No update available.
workarounds: An external protective measure is required.
* Minimize network exposure for affected products and ensure that they are not accessible via the Internet.
* Isolate affected products from the corporate network.
* If remote access is required, use secure methods such as virtual private networks (VPNs).