Lucene search

[email protected]CVE-2021-20994

HistoryMay 13, 2021 - 2:15 p.m.

CVE-2021-20994

2021-05-1314:15:17

CWE-79

[email protected]

web.nvd.nist.gov

wago

managed switches

vulnerability

web-based management

cve-2021-20994

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.0%

JSON

In multiple managed switches by WAGO in different versions an attacker may trick a legitimate user to click a link to inject possible malicious code into the Web-Based Management.

Affected configurations

NVD

Node

wago0852-0303_firmwareRange≤1.2.3.s0

AND

wago0852-0303Match-

Node

wago0852-1305_firmwareRange≤1.1.7.s0

AND

wago0852-1305Match-

Node

wago0852-1505_firmwareRange≤1.1.6.s0

AND

wago0852-1505Match-

Node

wago0852-1305\/000-001_firmwareRange≤1.0.4.s0

AND

wago0852-1305\/000-001Match-

Node

wago0852-1505\/000-001_firmwareRange≤1.0.4.s0

AND

wago0852-1505\/000-001Match-

CPENameOperatorVersion
wago:0852-0303_firmwarewago 0852-0303 firmwarele1.2.3.s0

CPE	Name	Operator	Version
wago:0852-0303_firmware	wago 0852-0303 firmware	le	1.2.3.s0

CNA Affected

[
  {
    "product": "0852-0303",
    "vendor": "WAGO",
    "versions": [
      {
        "lessThanOrEqual": "V1.2.3.S0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "0852-1305",
    "vendor": "WAGO",
    "versions": [
      {
        "lessThanOrEqual": "V1.1.7.S0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "0852-1505",
    "vendor": "WAGO",
    "versions": [
      {
        "lessThanOrEqual": "V1.1.6.S0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "0852-1305/000-001",
    "vendor": "WAGO",
    "versions": [
      {
        "lessThanOrEqual": "V1.0.4.S0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "0852-1505/000-001",
    "vendor": "WAGO",
    "versions": [
      {
        "lessThanOrEqual": "V1.0.4.S0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

cert.vde.com/en-us/advisories/vde-2021-013

Social References

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.0%

JSON

Related for CVE-2021-20994

nvd1 prion1 cvelist1