CVE-2021-34578 : This vulnerability allows an attacker who has access to the WBM to read and writ

This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically constructed requests without authentication on multiple WAGO PLCs in firmware versions up to FW07.

Published 2021-08-31 11:15:08

Updated 2021-09-08 16:02:25

Source CERT VDE

View at NVD, CVE.org

Vulnerability category: BypassGain privilege

Products affected by CVE-2021-34578

Wago » 750-362 Firmware
Versions up to, including, (<=) fw07
cpe:2.3:o:wago:750-362_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Wago » 750-362 » Version: N/A
Wago » 750-363 Firmware
Versions up to, including, (<=) fw07
cpe:2.3:o:wago:750-363_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Wago » 750-363 » Version: N/A
Wago » 750-823 Firmware
Versions up to, including, (<=) fw07
cpe:2.3:o:wago:750-823_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Wago » 750-823 » Version: N/A
Wago » 750-832 Firmware
Versions up to, including, (<=) fw07
cpe:2.3:o:wago:750-832_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Wago » 750-832 » Version: N/A
Wago » 750-862 Firmware
Versions up to, including, (<=) fw07
cpe:2.3:o:wago:750-862_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Wago » 750-862 » Version: N/A
Wago » 750-891 Firmware
Versions up to, including, (<=) fw07
cpe:2.3:o:wago:750-891_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Wago » 750-891 » Version: N/A
Wago » 750-893 Firmware
Versions up to, including, (<=) fw07
cpe:2.3:o:wago:750-893_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Wago » 750-893 » Version: N/A
Wago » 750-890/040-000 Firmware
Versions up to, including, (<=) fw07
cpe:2.3:o:wago:750-890\/040-000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Wago » 750-890/040-000 » Version: N/A
Wago » 750-890/025-001 Firmware
Versions up to, including, (<=) fw07
cpe:2.3:o:wago:750-890\/025-001_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Wago » 750-890/025-001 » Version: N/A
Wago » 750-890/025-002 Firmware
Versions up to, including, (<=) fw07
cpe:2.3:o:wago:750-890\/025-002_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Wago » 750-890/025-002 » Version: N/A
Wago » 750-890/025-000 Firmware
Versions up to, including, (<=) fw07
cpe:2.3:o:wago:750-890\/025-000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Wago » 750-890/025-000 » Version: N/A
Wago » 750-832/000-002 Firmware
Versions up to, including, (<=) fw07
cpe:2.3:o:wago:750-832\/000-002_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Wago » 750-832/000-002 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2021-34578

EPSS FAQ

0.31%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 70 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-34578

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P	8.6	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	CERT VDE
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
8.1	HIGH	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	2.2	5.9	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2021-34578

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Assigned by: info@cert.vde.com (Primary)

References for CVE-2021-34578

https://cert.vde.com/en-us/advisories/vde-2020-044

WAGO: Web-Based Management Authentication Vulnerability in WAGO 750-36X and WAGO 750-8XX Versions <= FW07 — English (USA)
Third Party Advisory

Jump to

Vulnerability Details : CVE-2021-34578

Products affected by CVE-2021-34578

Exploit prediction scoring system (EPSS) score for CVE-2021-34578

CVSS scores for CVE-2021-34578

CWE ids for CVE-2021-34578

References for CVE-2021-34578