Race Condition Vulnerability in Phoenix Contact FL SWITCH SMCS series products

Vulnerability

A denial-of-service vulnerability exists in Phoenix Contact FL SWITCH SMCS series products across multiple versions. When an attacker sends a hand-crafted TCP packet with the Urgent-Flag set and the Urgent-Pointer set to 0, the network stack of the device crashes, requiring a reboot [1].

Exploitation

The attacker must be able to send a specially crafted TCP packet to the target device over the network. No authentication is required, and the attack can be performed remotely. The single packet with the urgent pointer set to zero triggers the crash [1].

Impact

Successful exploitation results in a denial-of-service condition: the network stack crashes, rendering the device inoperative until manually rebooted. This can disrupt network communication and cause downtime in industrial environments [1].

Mitigation

As of the publication date (25 June 2021), no fix or workaround has been disclosed in the available references. Users should monitor vendor advisories for future patches. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog [1].