title: Race Condition Vulnerability in Phoenix Contact FL SWITCH SMCS series products
description: In Phoenix Contact FL SWITCH SMCS series products in multiple versions if an attacker sends a hand-crafted TCP-Packet with the Urgent-Flag set and the Urgent-Pointer set to 0, the network stack will crash. The device needs to be rebooted afterwards.
problem types: CWE-362 Race Condition (Concurrent Execution using Shared Resource with Improper Synchronization)
affected:
{
product: FL SWITCH
vendor: Phoenix Contact
versions:
lessThanOrEqual: 4.70, status: affected, version: SMCS 16TX (2700996), versionType: custom
lessThanOrEqual: 4.70, status: affected, version: SMCS 14TX/2FX (2700997), versionType: custom
lessThanOrEqual: 4.70, status: affected, version: SMCS 14TX/2FX-SM (2701466), versionType: custom
lessThanOrEqual: 4.70, status: affected, version: SMCS 8GT (2891123), versionType: custom
lessThanOrEqual: 4.70, status: affected, version: SMCS 6GT/2SFP (2891479), versionType: custom
lessThanOrEqual: 4.70, status: affected, version: SMCS 8TX-PN (2989103), versionType: custom
lessThanOrEqual: 4.70, status: affected, version: SMCS 4TX-PN (2989093), versionType: custom
lessThanOrEqual: 4.70, status: affected, version: SMCS 8TX (2989226), versionType: custom
lessThanOrEqual: 4.70, status: affected, version: SMCS 6TX/2SFP (2989323), versionType: custom
lessThanOrEqual: 4.70, status: affected, version: SMN 6TX/2POF-PN (2700290), versionType: custom
lessThanOrEqual: 4.70, status: affected, version: SMN 8TX-PN (2989501), versionType: custom
lessThanOrEqual: 4.70, status: affected, version: SMN 6TX/2FX (2989543), versionType: custom
lessThanOrEqual: 4.70, status: affected, version: SMN 6TX/2FX SM (2989556), versionType: custom
}
{
product: FL NAT
vendor: Phoenix Contact
versions:
lessThanOrEqual: 4.63, status: affected, version: SMN 8TX (2989365), versionType: custom
lessThanOrEqual: 4.63, status: affected, version: SMN 8TX-M (2702443), versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
workarounds: Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to the Phoenix Contact application note:
Measures to protect network-capable devices with Ethernet connection https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf