by Kastro
Paper/Archive/CVE-2021-21001

CVE-2021-21001

WAGO Series PFC200 Controller — WAGO: PFC200 Access to files outside the home directory

EPSS 1%CVSS 9.1
critical.is priorityof 100
41
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 66.5.665 × 2013.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

On WAGO PFC200 devices in different firmware versions with special crafted packets an authorised attacker with network access to the device can access the file system with higher privileges.

Affected

ProductAffectedFixed inSource
Series PFC200 Controller750-823 – FW07–CNA
Series PFC200 Controller750-829 – FW14–CNA
Series PFC200 Controller750-831/000-00x – FW14–CNA
Series PFC200 Controller750-832/000-00x – FW06–CNA
Series PFC200 Controller750-852 – FW14–CNA
Series PFC200 Controller750-862 – FW07–CNA
Series PFC200 Controller750-880/0xx-xxx – FW15–CNA
Series PFC200 Controller750-881 – FW14–CNA
Series PFC200 Controller750-882 – FW14–CNA
Series PFC200 Controller750-885/0xx-xxx – FW14–CNA
Series PFC200 Controller750-889 – FW14–CNA
Series PFC200 Controller750-890/0xx-xxx – FW07–CNA

Scores by source

CERTVDE (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

refcert.vde.com/en-us/advisories/vde-2021-014