by Kastro
Paper/Archive/CVE-2021-34578

CVE-2021-34578

WAGO PLC — WAGO: Authentication Vulnerability in Web-Based Management

EPSS 1.0%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 61.7.617 × 2012.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically constructed requests without authentication on multiple WAGO PLCs in firmware versions up to FW07.

Affected

ProductAffectedFixed inSource
PLC750-362 – FW07–CNA
PLC750-363 – FW07–CNA
PLC750-823 – FW07–CNA
PLC750-832/xxx-xxx – FW07–CNA
PLC750-862 – FW07–CNA
PLC750-891 – FW07–CNA
PLC750-890/xxx-xxx – FW07–CNA
PLC750-893 – FW07–CNA

Scores by source

CERTVDE (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refcert.vde.com/en-us/advisories/vde-2020-044