cnvd - cnvd-2021-40851

cnvd-2021-40851

Vulnerability from cnvd

Title: WAGO路径遍历漏洞

Description:

WAGO是德国万可（WAGO）的一款750-88x系列可编程逻辑控制器。该设备专门为在工业环境下应用而设计的数字运算操作电子系统。

WAGO PFC200设备存在安全漏洞，攻击者可利用该漏洞可以以更高的权限访问设备的网络访问文件系统。

Severity: 中

Patch Name: WAGO路径遍历漏洞的补丁

Patch Description:

WAGO是德国万可（WAGO）的一款750-88x系列可编程逻辑控制器。该设备专门为在工业环境下应用而设计的数字运算操作电子系统。

WAGO PFC200设备存在安全漏洞，攻击者可利用该漏洞可以以更高的权限访问设备的网络访问文件系统。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新: https://cert.vde.com/en-us/advisories/vde-2021-014

Reference: https://nvd.nist.gov/vuln/detail/CVE-2021-21001

Impacted products

Name
['WAGO 750-823_firmware >=fw07', 'WAGO 750-823', 'WAGO 750-829_firmware >=fw14', 'WAGO 750-829', 'WAGO 750-831_firmware >=fw14', 'WAGO 750-831', 'WAGO 750-832_firmware >=fw06', 'WAGO 750-832', 'WAGO 750-852_firmware >=fw14', 'WAGO 750-852', 'WAGO 750-862_firmware >=fw07', 'WAGO 750-862', 'WAGO 750-880_firmware >=fw15', 'WAGO 750-880', 'WAGO 750-881_firmware >=fw14', 'WAGO 750-881', 'WAGO 750-882_firmware >=fw14', 'WAGO 750-882', 'WAGO 750-885_firmware >=fw14', 'WAGO 750-885', 'WAGO 750-889_firmware >=fw14', 'WAGO 750-889', 'WAGO 750-890_firmware >=fw07', 'WAGO 750-890', 'WAGO 750-891_firmware >=fw07', 'WAGO 750-891', 'WAGO 750-893_firmware >=fw07', 'WAGO 750-893', 'WAGO 750-8202_firmware >=03.06.19_(18)', 'WAGO 750-8202', 'WAGO 750-8203_firmware >=03.06.19_(18)', 'WAGO 750-8203', 'WAGO 750-8204_firmware >=03.06.19_(18)', 'WAGO 750-8204', 'WAGO 750-8206_firmware >=03.06.19_(18)', 'WAGO 750-8206', 'WAGO 750-8207_firmware >=03.06.19_(18)', 'WAGO 750-8207', 'WAGO 750-8208_firmware >=03.06.19_(18)', 'WAGO 750-8208', 'WAGO 750-8210_firmware >=03.06.19_(18)', 'WAGO 750-8210', 'WAGO 750-8211_firmware >=03.06.19_(18)', 'WAGO 750-8211', 'WAGO 750-8212_firmware >=03.06.19_(18)', 'WAGO 750-8212', 'WAGO 750-8213_firmware >=03.06.19_(18)', 'WAGO 750-8213', 'WAGO 750-8214_firmware >=03.06.19_(18)', 'WAGO 750-8214', 'WAGO 750-8216_firmware >=03.06.19_(18)', 'WAGO 750-8216', 'WAGO 750-8217_firmware >=03.06.19_(18)', 'WAGO 750-8217']

Name

['WAGO 750-823_firmware >=fw07', 'WAGO 750-823', 'WAGO 750-829_firmware >=fw14', 'WAGO 750-829', 'WAGO 750-831_firmware >=fw14', 'WAGO 750-831', 'WAGO 750-832_firmware >=fw06', 'WAGO 750-832', 'WAGO 750-852_firmware >=fw14', 'WAGO 750-852', 'WAGO 750-862_firmware >=fw07', 'WAGO 750-862', 'WAGO 750-880_firmware >=fw15', 'WAGO 750-880', 'WAGO 750-881_firmware >=fw14', 'WAGO 750-881', 'WAGO 750-882_firmware >=fw14', 'WAGO 750-882', 'WAGO 750-885_firmware >=fw14', 'WAGO 750-885', 'WAGO 750-889_firmware >=fw14', 'WAGO 750-889', 'WAGO 750-890_firmware >=fw07', 'WAGO 750-890', 'WAGO 750-891_firmware >=fw07', 'WAGO 750-891', 'WAGO 750-893_firmware >=fw07', 'WAGO 750-893', 'WAGO 750-8202_firmware >=03.06.19_(18)', 'WAGO 750-8202', 'WAGO 750-8203_firmware >=03.06.19_(18)', 'WAGO 750-8203', 'WAGO 750-8204_firmware >=03.06.19_(18)', 'WAGO 750-8204', 'WAGO 750-8206_firmware >=03.06.19_(18)', 'WAGO 750-8206', 'WAGO 750-8207_firmware >=03.06.19_(18)', 'WAGO 750-8207', 'WAGO 750-8208_firmware >=03.06.19_(18)', 'WAGO 750-8208', 'WAGO 750-8210_firmware >=03.06.19_(18)', 'WAGO 750-8210', 'WAGO 750-8211_firmware >=03.06.19_(18)', 'WAGO 750-8211', 'WAGO 750-8212_firmware >=03.06.19_(18)', 'WAGO 750-8212', 'WAGO 750-8213_firmware >=03.06.19_(18)', 'WAGO 750-8213', 'WAGO 750-8214_firmware >=03.06.19_(18)', 'WAGO 750-8214', 'WAGO 750-8216_firmware >=03.06.19_(18)', 'WAGO 750-8216', 'WAGO 750-8217_firmware >=03.06.19_(18)', 'WAGO 750-8217']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-21001",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-21001"
    }
  },
  "description": "WAGO\u662f\u5fb7\u56fd\u4e07\u53ef\uff08WAGO\uff09\u7684\u4e00\u6b3e750-88x\u7cfb\u5217\u53ef\u7f16\u7a0b\u903b\u8f91\u63a7\u5236\u5668\u3002\u8be5\u8bbe\u5907\u4e13\u95e8\u4e3a\u5728\u5de5\u4e1a\u73af\u5883\u4e0b\u5e94\u7528\u800c\u8bbe\u8ba1\u7684\u6570\u5b57\u8fd0\u7b97\u64cd\u4f5c\u7535\u5b50\u7cfb\u7edf\u3002\n\nWAGO PFC200\u8bbe\u5907\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u53ef\u4ee5\u4ee5\u66f4\u9ad8\u7684\u6743\u9650\u8bbf\u95ee\u8bbe\u5907\u7684\u7f51\u7edc\u8bbf\u95ee\u6587\u4ef6\u7cfb\u7edf\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0:\r\nhttps://cert.vde.com/en-us/advisories/vde-2021-014",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-40851",
  "openTime": "2021-06-10",
  "patchDescription": "WAGO\u662f\u5fb7\u56fd\u4e07\u53ef\uff08WAGO\uff09\u7684\u4e00\u6b3e750-88x\u7cfb\u5217\u53ef\u7f16\u7a0b\u903b\u8f91\u63a7\u5236\u5668\u3002\u8be5\u8bbe\u5907\u4e13\u95e8\u4e3a\u5728\u5de5\u4e1a\u73af\u5883\u4e0b\u5e94\u7528\u800c\u8bbe\u8ba1\u7684\u6570\u5b57\u8fd0\u7b97\u64cd\u4f5c\u7535\u5b50\u7cfb\u7edf\u3002\r\n\r\nWAGO PFC200\u8bbe\u5907\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u53ef\u4ee5\u4ee5\u66f4\u9ad8\u7684\u6743\u9650\u8bbf\u95ee\u8bbe\u5907\u7684\u7f51\u7edc\u8bbf\u95ee\u6587\u4ef6\u7cfb\u7edf\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "WAGO\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "WAGO 750-823_firmware \u003e=fw07",
      "WAGO 750-823",
      "WAGO 750-829_firmware \u003e=fw14",
      "WAGO 750-829",
      "WAGO 750-831_firmware \u003e=fw14",
      "WAGO 750-831",
      "WAGO 750-832_firmware \u003e=fw06",
      "WAGO 750-832",
      "WAGO 750-852_firmware \u003e=fw14",
      "WAGO 750-852",
      "WAGO 750-862_firmware \u003e=fw07",
      "WAGO 750-862",
      "WAGO 750-880_firmware \u003e=fw15",
      "WAGO 750-880",
      "WAGO 750-881_firmware \u003e=fw14",
      "WAGO 750-881",
      "WAGO 750-882_firmware \u003e=fw14",
      "WAGO 750-882",
      "WAGO 750-885_firmware \u003e=fw14",
      "WAGO 750-885",
      "WAGO 750-889_firmware \u003e=fw14",
      "WAGO 750-889",
      "WAGO 750-890_firmware \u003e=fw07",
      "WAGO 750-890",
      "WAGO 750-891_firmware \u003e=fw07",
      "WAGO 750-891",
      "WAGO 750-893_firmware \u003e=fw07",
      "WAGO 750-893",
      "WAGO 750-8202_firmware \u003e=03.06.19_(18)",
      "WAGO 750-8202",
      "WAGO 750-8203_firmware \u003e=03.06.19_(18)",
      "WAGO 750-8203",
      "WAGO 750-8204_firmware \u003e=03.06.19_(18)",
      "WAGO 750-8204",
      "WAGO 750-8206_firmware \u003e=03.06.19_(18)",
      "WAGO 750-8206",
      "WAGO 750-8207_firmware \u003e=03.06.19_(18)",
      "WAGO 750-8207",
      "WAGO 750-8208_firmware \u003e=03.06.19_(18)",
      "WAGO 750-8208",
      "WAGO 750-8210_firmware \u003e=03.06.19_(18)",
      "WAGO 750-8210",
      "WAGO 750-8211_firmware \u003e=03.06.19_(18)",
      "WAGO 750-8211",
      "WAGO 750-8212_firmware \u003e=03.06.19_(18)",
      "WAGO 750-8212",
      "WAGO 750-8213_firmware \u003e=03.06.19_(18)",
      "WAGO 750-8213",
      "WAGO 750-8214_firmware \u003e=03.06.19_(18)",
      "WAGO 750-8214",
      "WAGO 750-8216_firmware \u003e=03.06.19_(18)",
      "WAGO 750-8216",
      "WAGO 750-8217_firmware \u003e=03.06.19_(18)",
      "WAGO 750-8217"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2021-21001",
  "serverity": "\u4e2d",
  "submitTime": "2021-06-09",
  "title": "WAGO\u8def\u5f84\u904d\u5386\u6f0f\u6d1e"
}

CVE-2021-21001 (GCVE-0-2021-21001)

Vulnerability from cvelistv5

Published

2021-05-24 11:05

Modified

2024-09-16 16:19

Severity ?

9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Summary

On WAGO PFC200 devices in different firmware versions with special crafted packets an authorised attacker with network access to the device can access the file system with higher privileges.

References

▼	URL	Tags
	https://cert.vde.com/en-us/advisories/vde-2021-014	x_refsource_CONFIRM

Impacted products

Vendor

Product

Version

▼

WAGO

Series PFC200 Controller

Version: 750-823   <
Version: 750-829   <
Version: 750-831/000-00x   <
Version: 750-832/000-00x   <
Version: 750-852   <
Version: 750-862   <
Version: 750-880/0xx-xxx   <
Version: 750-881   <
Version: 750-882   <
Version: 750-885/0xx-xxx   <
Version: 750-889   <
Version: 750-890/0xx-xxx   <
Version: 750-891   <
Version: 750-893   <

WAGO

Series Ethernet Controller

Version: 750-8202/xxx-xxx   < 03.06.19 (18)
Version: 750-8203/xxx-xxx   < 03.06.19 (18)
Version: 750-8204/xxx-xxx   < 03.06.19 (18)
Version: 750-8206/xxx-xxx   < 03.06.19 (18)
Version: 750-8207/xxx-xxx   < 03.06.19 (18)
Version: 750-8208/xxx-xxx   < 03.06.19 (18)
Version: 750-8210/xxx-xxx   < 03.06.19 (18)
Version: 750-8211/xxx-xxx   < 03.06.19 (18)
Version: 750-8212/xxx-xxx   < 03.06.19 (18)
Version: 750-8213/xxx-xxx   < 03.06.19 (18)
Version: 750-8214/xxx-xxx   < 03.06.19 (18)
Version: 750-8216/xxx-xxx   < 03.06.19 (18)
Version: 750-8217/xxx-xxx   < 03.06.19 (18)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:53:23.101Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert.vde.com/en-us/advisories/vde-2021-014"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Series PFC200 Controller",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThanOrEqual": "FW07",
              "status": "affected",
              "version": "750-823",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "FW14",
              "status": "affected",
              "version": "750-829",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "FW14",
              "status": "affected",
              "version": "750-831/000-00x",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "FW06",
              "status": "affected",
              "version": "750-832/000-00x",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "FW14",
              "status": "affected",
              "version": "750-852",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "FW07",
              "status": "affected",
              "version": "750-862",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "FW15",
              "status": "affected",
              "version": "750-880/0xx-xxx",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "FW14",
              "status": "affected",
              "version": "750-881",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "FW14",
              "status": "affected",
              "version": "750-882",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "FW14",
              "status": "affected",
              "version": "750-885/0xx-xxx",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "FW14",
              "status": "affected",
              "version": "750-889",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "FW07",
              "status": "affected",
              "version": "750-890/0xx-xxx",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "FW07",
              "status": "affected",
              "version": "750-891",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "FW07",
              "status": "affected",
              "version": "750-893",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Series Ethernet Controller",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "03.06.19 (18)",
              "status": "affected",
              "version": "750-8202/xxx-xxx",
              "versionType": "custom"
            },
            {
              "lessThan": "03.06.19 (18)",
              "status": "affected",
              "version": "750-8203/xxx-xxx",
              "versionType": "custom"
            },
            {
              "lessThan": "03.06.19 (18)",
              "status": "affected",
              "version": "750-8204/xxx-xxx",
              "versionType": "custom"
            },
            {
              "lessThan": "03.06.19 (18)",
              "status": "affected",
              "version": "750-8206/xxx-xxx",
              "versionType": "custom"
            },
            {
              "lessThan": "03.06.19 (18)",
              "status": "affected",
              "version": "750-8207/xxx-xxx",
              "versionType": "custom"
            },
            {
              "lessThan": "03.06.19 (18)",
              "status": "affected",
              "version": "750-8208/xxx-xxx",
              "versionType": "custom"
            },
            {
              "lessThan": "03.06.19 (18)",
              "status": "affected",
              "version": "750-8210/xxx-xxx",
              "versionType": "custom"
            },
            {
              "lessThan": "03.06.19 (18)",
              "status": "affected",
              "version": "750-8211/xxx-xxx",
              "versionType": "custom"
            },
            {
              "lessThan": "03.06.19 (18)",
              "status": "affected",
              "version": "750-8212/xxx-xxx",
              "versionType": "custom"
            },
            {
              "lessThan": "03.06.19 (18)",
              "status": "affected",
              "version": "750-8213/xxx-xxx",
              "versionType": "custom"
            },
            {
              "lessThan": "03.06.19 (18)",
              "status": "affected",
              "version": "750-8214/xxx-xxx",
              "versionType": "custom"
            },
            {
              "lessThan": "03.06.19 (18)",
              "status": "affected",
              "version": "750-8216/xxx-xxx",
              "versionType": "custom"
            },
            {
              "lessThan": "03.06.19 (18)",
              "status": "affected",
              "version": "750-8217/xxx-xxx",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "These vulnerabilities were reported by JSC Positive Technologies (Vyacheslav Moskvin, Anton Dorfman, Sergey Fedonin, Ivan Kurnakov, Denis Goryushev). Coordination done by CERT@VDE."
        }
      ],
      "datePublic": "2021-05-20T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "On WAGO PFC200 devices in different firmware versions with special crafted packets an authorised attacker with network access to the device can access the file system with higher privileges."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-05-24T11:05:06",
        "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
        "shortName": "CERTVDE"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert.vde.com/en-us/advisories/vde-2021-014"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "WAGO recommends all effected users with CODESYS 2.3 Runtime PLCs to update to the firmware versions listed at https://cert.vde.com/en-us/advisories/vde-2021-014 in the solution paragraph."
        }
      ],
      "source": {
        "advisory": "VDE-2021-014",
        "defect": [
          "VDE-2021-014"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "WAGO: PFC200 Access to files outside the home directory",
      "workarounds": [
        {
          "lang": "en",
          "value": "Use general security best practices to protect systems from local and network attacks.\nDo not allow direct access to the device from untrusted networks.\nUpdate to the latest firmware according to the table in chapter solutions."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "info@cert.vde.com",
          "DATE_PUBLIC": "2021-05-20T10:00:00.000Z",
          "ID": "CVE-2021-21001",
          "STATE": "PUBLIC",
          "TITLE": "WAGO: PFC200 Access to files outside the home directory"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Series PFC200 Controller",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "750-823",
                            "version_value": "FW07"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "750-829",
                            "version_value": "FW14"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "750-831/000-00x",
                            "version_value": "FW14"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "750-832/000-00x",
                            "version_value": "FW06"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "750-852",
                            "version_value": "FW14"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "750-862",
                            "version_value": "FW07"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "750-880/0xx-xxx",
                            "version_value": "FW15"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "750-881",
                            "version_value": "FW14"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "750-882",
                            "version_value": "FW14"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "750-885/0xx-xxx",
                            "version_value": "FW14"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "750-889",
                            "version_value": "FW14"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "750-890/0xx-xxx",
                            "version_value": "FW07"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "750-891",
                            "version_value": "FW07"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "750-893",
                            "version_value": "FW07"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Series Ethernet Controller",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "750-8202/xxx-xxx",
                            "version_value": "03.06.19 (18)"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "750-8203/xxx-xxx",
                            "version_value": "03.06.19 (18)"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "750-8204/xxx-xxx",
                            "version_value": "03.06.19 (18)"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "750-8206/xxx-xxx",
                            "version_value": "03.06.19 (18)"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "750-8207/xxx-xxx",
                            "version_value": "03.06.19 (18)"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "750-8208/xxx-xxx",
                            "version_value": "03.06.19 (18)"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "750-8210/xxx-xxx",
                            "version_value": "03.06.19 (18)"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "750-8211/xxx-xxx",
                            "version_value": "03.06.19 (18)"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "750-8212/xxx-xxx",
                            "version_value": "03.06.19 (18)"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "750-8213/xxx-xxx",
                            "version_value": "03.06.19 (18)"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "750-8214/xxx-xxx",
                            "version_value": "03.06.19 (18)"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "750-8216/xxx-xxx",
                            "version_value": "03.06.19 (18)"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "750-8217/xxx-xxx",
                            "version_value": "03.06.19 (18)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "WAGO"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "These vulnerabilities were reported by JSC Positive Technologies (Vyacheslav Moskvin, Anton Dorfman, Sergey Fedonin, Ivan Kurnakov, Denis Goryushev). Coordination done by CERT@VDE."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "On WAGO PFC200 devices in different firmware versions with special crafted packets an authorised attacker with network access to the device can access the file system with higher privileges."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://cert.vde.com/en-us/advisories/vde-2021-014",
              "refsource": "CONFIRM",
              "url": "https://cert.vde.com/en-us/advisories/vde-2021-014"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "WAGO recommends all effected users with CODESYS 2.3 Runtime PLCs to update to the firmware versions listed at https://cert.vde.com/en-us/advisories/vde-2021-014 in the solution paragraph."
          }
        ],
        "source": {
          "advisory": "VDE-2021-014",
          "defect": [
            "VDE-2021-014"
          ],
          "discovery": "EXTERNAL"
        },
        "work_around": [
          {
            "lang": "en",
            "value": "Use general security best practices to protect systems from local and network attacks.\nDo not allow direct access to the device from untrusted networks.\nUpdate to the latest firmware according to the table in chapter solutions."
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
    "assignerShortName": "CERTVDE",
    "cveId": "CVE-2021-21001",
    "datePublished": "2021-05-24T11:05:06.147811Z",
    "dateReserved": "2020-12-17T00:00:00",
    "dateUpdated": "2024-09-16T16:19:02.930Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted