by Kastro
Paper/Archive/CVE-2021-20998

CVE-2021-20998

WAGO 0852-0303 — WAGO: Managed Switches: Unauthorized creation of user accounts

EPSS 1%CVSS 10.0
critical.is priorityof 100
43
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 66.0.660 × 2013.2No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

In multiple managed switches by WAGO in different versions without authorization and with specially crafted packets it is possible to create users.

Affected

ProductAffectedFixed inSource
0852-0303unspecified – V1.2.3.S0–CNA
0852-1305unspecified – V1.1.7.S0–CNA
0852-1505unspecified – V1.1.6.S0–CNA
0852-1305/000-001unspecified – V1.0.4.S0–CNA
0852-1505/000-001unspecified – V1.0.4.S0–CNA

Scores by source

CERTVDE (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refcert.vde.com/en-us/advisories/vde-2021-013