CVE-2021-30066
On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, an arbitrary firmware image can be loaded because firmware signature verification (for a USB stick) can be bypassed. NOTE: this issue exists because of an incomplete fix of CVE-2017-11400.
- Score
- CVSS 3.1 6.8 Medium
- Status
- Modified - cve@mitre.org
- Published
- 2022-04-03
- Last modified
- 2024-08-03
- Weaknesses
- CWE-347
Affected products
- Eagle 20 Tofino 943 987-501-tx/tx Firmware (Belden)
- Eagle 20 Tofino 943 987-502 -tx/mm Firmware (Belden)
- Eagle 20 Tofino 943 987-504-mm/tx Firmware (Belden)
- Eagle 20 Tofino 943 987-505-mm/mm Firmware (Belden)
- Tofino Argon Fa-tsa-100-tx/tx Firmware (Belden)
- Tofino Argon Fa-tsa-220-mm/mm Firmware (Belden)
- Tofino Argon Fa-tsa-220-mm/tx Firmware (Belden)
- Tofino Argon Fa-tsa-220-tx/mm Firmware (Belden)
- Tofino Argon Fa-tsa-220-tx/tx Firmware (Belden)
- Tofino Xenon Security Appliance Firmware (Belden)
- Tcsefea23f3f20 Firmware (Schneider-electric)
- Tcsefea23f3f21 Firmware (Schneider-electric)
- Tcsefea23f3f22 Firmware (Schneider-electric)
References
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-05
- https://www.belden.com/support/security-assurance
