2020-12-17 22:03:03 +00:00
{
"CVE_data_meta" : {
2021-05-21 08:57:17 +02:00
"ASSIGNER" : "info@cert.vde.com" ,
"DATE_PUBLIC" : "2021-05-20T10:00:00.000Z" ,
2020-12-17 22:03:03 +00:00
"ID" : "CVE-2021-21000" ,
2021-05-21 08:57:17 +02:00
"STATE" : "PUBLIC" ,
"TITLE" : "WAGO: PFC200 Denial of Service due to the number of connections to the runtime"
2020-12-17 22:03:03 +00:00
} ,
2021-05-21 08:57:17 +02:00
"affects" : {
"vendor" : {
"vendor_data" : [
{
"product" : {
"product_data" : [
{
"product_name" : "Series PFC200 Controller" ,
"version" : {
"version_data" : [
{
"version_affected" : "<=" ,
"version_name" : "750-823" ,
"version_value" : "FW07"
} ,
{
"version_affected" : "<=" ,
"version_name" : "750-829" ,
"version_value" : "FW14"
} ,
{
"version_affected" : "<=" ,
"version_name" : "750-831/000-00x" ,
"version_value" : "FW14"
} ,
{
"version_affected" : "<=" ,
"version_name" : "750-832/000-00x" ,
"version_value" : "FW06"
} ,
{
"version_affected" : "<=" ,
"version_name" : "750-852" ,
"version_value" : "FW14"
} ,
{
"version_affected" : "<=" ,
"version_name" : "750-862" ,
"version_value" : "FW07"
} ,
{
"version_affected" : "<=" ,
"version_name" : "750-880/0xx-xxx" ,
"version_value" : "FW15"
} ,
{
"version_affected" : "<=" ,
"version_name" : "750-881" ,
"version_value" : "FW14"
} ,
{
"version_affected" : "<=" ,
"version_name" : "750-882" ,
"version_value" : "FW14"
} ,
{
"version_affected" : "<=" ,
"version_name" : "750-885/0xx-xxx" ,
"version_value" : "FW14"
} ,
{
"version_affected" : "<=" ,
"version_name" : "750-889" ,
"version_value" : "FW14"
} ,
{
"version_affected" : "<=" ,
"version_name" : "750-890/0xx-xxx" ,
"version_value" : "FW07"
} ,
{
"version_affected" : "<=" ,
"version_name" : "750-891" ,
"version_value" : "FW07"
} ,
{
"version_affected" : "<=" ,
"version_name" : "750-893" ,
"version_value" : "FW07"
}
]
}
} ,
{
"product_name" : "Series Ethernet Controller" ,
"version" : {
"version_data" : [
{
"version_affected" : "<" ,
"version_name" : "750-8202/xxx-xxx" ,
"version_value" : "03.06.19 (18)"
} ,
{
"version_affected" : "<" ,
"version_name" : "750-8203/xxx-xxx" ,
"version_value" : "03.06.19 (18)"
} ,
{
"version_affected" : "<" ,
"version_name" : "750-8204/xxx-xxx" ,
"version_value" : "03.06.19 (18)"
} ,
{
"version_affected" : "<" ,
"version_name" : "750-8206/xxx-xxx" ,
"version_value" : "03.06.19 (18)"
} ,
{
"version_affected" : "<" ,
"version_name" : "750-8207/xxx-xxx" ,
"version_value" : "03.06.19 (18)"
} ,
{
"version_affected" : "<" ,
"version_name" : "750-8208/xxx-xxx" ,
"version_value" : "03.06.19 (18)"
} ,
{
"version_affected" : "<" ,
"version_name" : "750-8210/xxx-xxx" ,
"version_value" : "03.06.19 (18)"
} ,
{
"version_affected" : "<" ,
"version_name" : "750-8211/xxx-xxx" ,
"version_value" : "03.06.19 (18)"
} ,
{
"version_affected" : "<" ,
"version_name" : "750-8212/xxx-xxx" ,
"version_value" : "03.06.19 (18)"
} ,
{
"version_affected" : "<" ,
"version_name" : "750-8213/xxx-xxx" ,
"version_value" : "03.06.19 (18)"
} ,
{
"version_affected" : "<" ,
"version_name" : "750-8214/xxx-xxx" ,
"version_value" : "03.06.19 (18)"
} ,
{
"version_affected" : "<" ,
"version_name" : "750-8216/xxx-xxx" ,
"version_value" : "03.06.19 (18)"
} ,
{
"version_affected" : "<" ,
"version_name" : "750-8217/xxx-xxx" ,
"version_value" : "03.06.19 (18)"
}
]
}
}
]
} ,
"vendor_name" : "WAGO"
}
]
}
} ,
"credit" : [
{
"lang" : "eng" ,
"value" : "These vulnerabilities were reported by JSC Positive Technologies (Vyacheslav Moskvin, Anton Dorfman, Sergey Fedonin, Ivan Kurnakov, Denis Goryushev). Coordination done by CERT@VDE."
}
] ,
"data_format" : "MITRE" ,
"data_type" : "CVE" ,
"data_version" : "4.0" ,
2020-12-17 22:03:03 +00:00
"description" : {
"description_data" : [
{
"lang" : "eng" ,
2021-05-21 08:57:17 +02:00
"value" : "On WAGO PFC200 devices in different firmware versions with special crafted packets an attacker with network access to the device could cause a denial of service for the login service of the runtime."
2020-12-17 22:03:03 +00:00
}
]
2021-05-21 08:57:17 +02:00
} ,
"generator" : {
"engine" : "Vulnogram 0.0.9"
} ,
"impact" : {
"cvss" : {
"attackComplexity" : "LOW" ,
"attackVector" : "NETWORK" ,
"availabilityImpact" : "LOW" ,
"baseScore" : 5.3 ,
"baseSeverity" : "MEDIUM" ,
"confidentialityImpact" : "NONE" ,
"integrityImpact" : "NONE" ,
"privilegesRequired" : "NONE" ,
"scope" : "UNCHANGED" ,
"userInteraction" : "NONE" ,
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" ,
"version" : "3.1"
}
} ,
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng" ,
"value" : "CWE-770 Allocation of Resources Without Limits or Throttling"
}
]
}
]
} ,
"references" : {
"reference_data" : [
{
"name" : "https://cert.vde.com/en-us/advisories/vde-2021-014" ,
"refsource" : "CONFIRM" ,
"url" : "https://cert.vde.com/en-us/advisories/vde-2021-014"
}
]
} ,
"solution" : [
{
"lang" : "eng" ,
"value" : "WAGO recommends all effected users with CODESYS 2.3 Runtime PLCs to update to the firmware versions listed at https://cert.vde.com/en-us/advisories/vde-2021-014 in the solution paragraph."
}
] ,
"source" : {
"advisory" : "VDE-2021-014" ,
"defect" : [
"VDE-2021-014"
] ,
"discovery" : "EXTERNAL"
} ,
"work_around" : [
{
"lang" : "eng" ,
"value" : "Use general security best practices to protect systems from local and network attacks.\nDo not allow direct access to the device from untrusted networks.\nUpdate to the latest firmware according to the table in chapter solutions."
}
]
2020-12-17 22:03:03 +00:00
}
