Phoenix Contact: Undocumented FTP acces in certain AXL F BK and IL BK devices
Priority LOW 33CWE-798Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-798.
Summary
In certain devices of the Phoenix Contact AXL F BK and IL BK product families an undocumented password protected FTP access to the root directory exists.
Why it matters now
EPSS 0.00723 54th percentileScored 2026-11-07
Fix Fixed AXL F BK (Phoenix Contact): 1.30, 1.40
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Phoenix Contact | AXL F BK | AXL F PN TPS XC (1068857) to before 1.30; AXL F EIP EF (2702782) to before 1.30 | 1.30 | Patch available | CNA |
| Phoenix Contact | AXL F BK | AXL F PN TPS (2403869) to before 1.30 | 1.30 | Patch available | CNA |
| Phoenix Contact | AXL F BK | AXL F EIP (2688394) to before 1.30; AXL F ETH (2688459) to before 1.30; AXL F ETH XC (2701949) to before 1.30; AXL F S3 (2701686) to before 1.40 | 1.30, 1.40 | Patch available | CNA |
| Phoenix Contact | AXL F BK | AXL F PN (2701815) all revisions; AXL F PN XC (2701222) all revisions; AXL F ETH NET2 (2702177) all revisions; AXL F SAS (2701457) all revisions | — | No fix listed | CNA |
| Phoenix Contact | IL | IL PN BK-PAC (2403696) all revisions; IL PN BK DI8 DO4 2TX-PAC (2703994) all revisions; IL PN BK DI8 DO4 2SCRJ-PAC (2878379) all revisions; IL ETH BK DI8 DO4 2TX-XC-PAC (2701388) all revisions; IL ETH BK DI8 DO4 2TX-PAC (2703981) all revisions; IL EIP BK DI8 DO4 2TX-PAC (2897758) all revisions; IL S3 BK DI8 DO4 2TX-PAC (2692380) all revisions | — | No fix listed | CNA |
- AXL F BK VendorPhoenix Contact Affected AXL F PN TPS XC (1068857) to before 1.30; AXL F EIP EF (2702782) to before 1.30 Fixed in 1.30 Patch available CNA
- AXL F BK VendorPhoenix Contact Affected AXL F PN TPS (2403869) to before 1.30 Fixed in 1.30 Patch available CNA
- AXL F BK VendorPhoenix Contact Affected AXL F EIP (2688394) to before 1.30; AXL F ETH (2688459) to before 1.30; AXL F ETH XC (2701949) to before 1.30; AXL F S3 (2701686) to before 1.40 Fixed in 1.30, 1.40 Patch available CNA
- AXL F BK VendorPhoenix Contact Affected AXL F PN (2701815) all revisions; AXL F PN XC (2701222) all revisions; AXL F ETH NET2 (2702177) all revisions; AXL F SAS (2701457) all revisions Fixed in — No fix listed CNA
- IL VendorPhoenix Contact Affected IL PN BK-PAC (2403696) all revisions; IL PN BK DI8 DO4 2TX-PAC (2703994) all revisions; IL PN BK DI8 DO4 2SCRJ-PAC (2878379) all revisions; IL ETH BK DI8 DO4 2TX-XC-PAC (2701388) all revisions; IL ETH BK DI8 DO4 2TX-PAC (2703981) all revisions; IL EIP BK DI8 DO4 2TX-PAC (2897758) all revisions; IL S3 BK DI8 DO4 2TX-PAC (2692380) all revisions Fixed in — No fix listed CNA
CPE configurations NVD · 36
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:phoenixcontact:axl_f_bk_pn_tps_xc_firmware:*:*:*:*:*:*:*:* | before 1.30 | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:axl_f_bk_pn_tps_xc:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:axl_f_bk_pn_tps_firmware:*:*:*:*:*:*:*:* | before 1.30 | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:axl_f_bk_pn_tps:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:axl_f_bk_eip_firmware:*:*:*:*:*:*:*:* | before 1.30 | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:axl_f_bk_eip:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:axl_f_bk_eip_ef_firmware:*:*:*:*:*:*:*:* | before 1.30 | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:axl_f_bk_eip_ef:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:axl_f_bk_eth_firmware:*:*:*:*:*:*:*:* | before 1.30 | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:axl_f_bk_eth:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
- cpe:2.3:o:phoenixcontact:axl_f_bk_pn_tps_xc_firmware:*:*:*:*:*:*:*:* Versions before 1.30 Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:axl_f_bk_pn_tps_xc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:axl_f_bk_pn_tps_firmware:*:*:*:*:*:*:*:* Versions before 1.30 Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:axl_f_bk_pn_tps:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:axl_f_bk_eip_firmware:*:*:*:*:*:*:*:* Versions before 1.30 Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:axl_f_bk_eip:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:axl_f_bk_eip_ef_firmware:*:*:*:*:*:*:*:* Versions before 1.30 Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:axl_f_bk_eip_ef:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:axl_f_bk_eth_firmware:*:*:*:*:*:*:*:* Versions before 1.30 Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:axl_f_bk_eth:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
Show 26 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:phoenixcontact:axl_f_bk_eth_xc_firmware:*:*:*:*:*:*:*:* | before 1.30 | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:axl_f_bk_eth_xc:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:axl_f_bk_s35_firmware:*:*:*:*:*:*:*:* | before 1.40 | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:axl_f_bk_s35:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:axl_f_bk_pn_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:axl_f_bk_pn:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:axl_f_bk_pn_xc_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:axl_f_bk_pn_xc:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:axl_f_bk_eth_net2_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:axl_f_bk_eth_net2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:axl_f_bk_sas_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:axl_f_bk_sas:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:il_pn_bk-pac_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:il_pn_bk-pac:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:il_pn_bk_di8_do4_2tx-pac_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:il_pn_bk_di8_do4_2tx-pac:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:il_pn_bk_di8_do4_2scrj-pac_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:il_pn_bk_di8_do4_2scrj-pac:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:il_eth_bk_di8_do4_2tx-xc-pac_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:il_eth_bk_di8_do4_2tx-xc-pac:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:il_eth_bk_di8_do4_2tx-pac_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:il_eth_bk_di8_do4_2tx-pac:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:il_eip_bk_di8_do4_2tx-pac_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:il_eip_bk_di8_do4_2tx-pac:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
| cpe:2.3:o:phoenixcontact:il_s3_bk_di8_do4_2tx-pac_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Phoenixcontact |
| cpe:2.3:h:phoenixcontact:il_s3_bk_di8_do4_2tx-pac:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phoenixcontact |
- cpe:2.3:o:phoenixcontact:axl_f_bk_eth_xc_firmware:*:*:*:*:*:*:*:* Versions before 1.30 Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:axl_f_bk_eth_xc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:axl_f_bk_s35_firmware:*:*:*:*:*:*:*:* Versions before 1.40 Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:axl_f_bk_s35:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:axl_f_bk_pn_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:axl_f_bk_pn:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:axl_f_bk_pn_xc_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:axl_f_bk_pn_xc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:axl_f_bk_eth_net2_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:axl_f_bk_eth_net2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:axl_f_bk_sas_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:axl_f_bk_sas:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:il_pn_bk-pac_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:il_pn_bk-pac:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:il_pn_bk_di8_do4_2tx-pac_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:il_pn_bk_di8_do4_2tx-pac:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:il_pn_bk_di8_do4_2scrj-pac_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:il_pn_bk_di8_do4_2scrj-pac:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:il_eth_bk_di8_do4_2tx-xc-pac_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:il_eth_bk_di8_do4_2tx-xc-pac:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:il_eth_bk_di8_do4_2tx-pac_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:il_eth_bk_di8_do4_2tx-pac:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:il_eip_bk_di8_do4_2tx-pac_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:il_eip_bk_di8_do4_2tx-pac:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
- cpe:2.3:o:phoenixcontact:il_s3_bk_di8_do4_2tx-pac_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Phoenixcontact
- cpe:2.3:h:phoenixcontact:il_s3_bk_di8_do4_2tx-pac:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
Remediation
- Fix · CNA AXL F BK (Phoenix Contact) Fixed in 1.30
- Fix · CNA AXL F BK (Phoenix Contact) Fixed in 1.30
- Fix · CNA AXL F BK (Phoenix Contact) Fixed in 1.30, 1.40
Timeline
- 2026-10-02 Threatist record created from CVE-2021-33540
- 2026-10-03 Alias added: GHSA-vgp3-9m7m-h7cr
References
More Phoenix Contact vulnerabilities
- TI-2014-07463 Phoenix Contact Software ProConOs and MultiProg Missing Authentication for Critical Function CVSS 2.0CRITICAL 10.0
- TI-2024-17093 PHOENIX CONTACT: Remote code execution in CHARX Series CVSS 3.1CRITICAL 9.8
- TI-2022-13692 Insufficient Verification of Data Vulnerability in PHOENIX CONTACT classic line industrial controllers CVSS 3.1CRITICAL 9.8
- TI-2026-21959 Remote code execution via uploading a malicious IODD file CVSS 3.1CRITICAL 9.8
- TI-2026-21940 Authentication Bypass in _account_log CVSS 3.1CRITICAL 9.8
- TI-2023-03334 PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels CVSS 3.1CRITICAL 10.0
Sources
- CVE-2021-33540 · CVE Program
- CVE-2021-33540 · NVD
- FIRST EPSS
- GHSA-vgp3-9m7m-h7cr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences