2020-12-17 22:03:03 +00:00
{
"CVE_data_meta" : {
2021-05-21 08:57:17 +02:00
"ASSIGNER" : "info@cert.vde.com" ,
"DATE_PUBLIC" : "2021-05-20T10:00:00.000Z" ,
2020-12-17 22:03:03 +00:00
"ID" : "CVE-2021-21001" ,
2021-05-21 08:57:17 +02:00
"STATE" : "PUBLIC" ,
"TITLE" : "WAGO: PFC200 Access to files outside the home directory"
2020-12-17 22:03:03 +00:00
} ,
2021-05-21 08:57:17 +02:00
"affects" : {
"vendor" : {
"vendor_data" : [
{
"product" : {
"product_data" : [
{
"product_name" : "Series PFC200 Controller" ,
"version" : {
"version_data" : [
{
"version_affected" : "<=" ,
"version_name" : "750-823" ,
"version_value" : "FW07"
} ,
{
"version_affected" : "<=" ,
"version_name" : "750-829" ,
"version_value" : "FW14"
} ,
{
"version_affected" : "<=" ,
"version_name" : "750-831/000-00x" ,
"version_value" : "FW14"
} ,
{
"version_affected" : "<=" ,
"version_name" : "750-832/000-00x" ,
"version_value" : "FW06"
} ,
{
"version_affected" : "<=" ,
"version_name" : "750-852" ,
"version_value" : "FW14"
} ,
{
"version_affected" : "<=" ,
"version_name" : "750-862" ,
"version_value" : "FW07"
} ,
{
"version_affected" : "<=" ,
"version_name" : "750-880/0xx-xxx" ,
"version_value" : "FW15"
} ,
{
"version_affected" : "<=" ,
"version_name" : "750-881" ,
"version_value" : "FW14"
} ,
{
"version_affected" : "<=" ,
"version_name" : "750-882" ,
"version_value" : "FW14"
} ,
{
"version_affected" : "<=" ,
"version_name" : "750-885/0xx-xxx" ,
"version_value" : "FW14"
} ,
{
"version_affected" : "<=" ,
"version_name" : "750-889" ,
"version_value" : "FW14"
} ,
{
"version_affected" : "<=" ,
"version_name" : "750-890/0xx-xxx" ,
"version_value" : "FW07"
} ,
{
"version_affected" : "<=" ,
"version_name" : "750-891" ,
"version_value" : "FW07"
} ,
{
"version_affected" : "<=" ,
"version_name" : "750-893" ,
"version_value" : "FW07"
}
]
}
} ,
{
"product_name" : "Series Ethernet Controller" ,
"version" : {
"version_data" : [
{
"version_affected" : "<" ,
"version_name" : "750-8202/xxx-xxx" ,
"version_value" : "03.06.19 (18)"
} ,
{
"version_affected" : "<" ,
"version_name" : "750-8203/xxx-xxx" ,
"version_value" : "03.06.19 (18)"
} ,
{
"version_affected" : "<" ,
"version_name" : "750-8204/xxx-xxx" ,
"version_value" : "03.06.19 (18)"
} ,
{
"version_affected" : "<" ,
"version_name" : "750-8206/xxx-xxx" ,
"version_value" : "03.06.19 (18)"
} ,
{
"version_affected" : "<" ,
"version_name" : "750-8207/xxx-xxx" ,
"version_value" : "03.06.19 (18)"
} ,
{
"version_affected" : "<" ,
"version_name" : "750-8208/xxx-xxx" ,
"version_value" : "03.06.19 (18)"
} ,
{
"version_affected" : "<" ,
"version_name" : "750-8210/xxx-xxx" ,
"version_value" : "03.06.19 (18)"
} ,
{
"version_affected" : "<" ,
"version_name" : "750-8211/xxx-xxx" ,
"version_value" : "03.06.19 (18)"
} ,
{
"version_affected" : "<" ,
"version_name" : "750-8212/xxx-xxx" ,
"version_value" : "03.06.19 (18)"
} ,
{
"version_affected" : "<" ,
"version_name" : "750-8213/xxx-xxx" ,
"version_value" : "03.06.19 (18)"
} ,
{
"version_affected" : "<" ,
"version_name" : "750-8214/xxx-xxx" ,
"version_value" : "03.06.19 (18)"
} ,
{
"version_affected" : "<" ,
"version_name" : "750-8216/xxx-xxx" ,
"version_value" : "03.06.19 (18)"
} ,
{
"version_affected" : "<" ,
"version_name" : "750-8217/xxx-xxx" ,
"version_value" : "03.06.19 (18)"
}
]
}
}
]
} ,
"vendor_name" : "WAGO"
}
]
}
} ,
"credit" : [
{
"lang" : "eng" ,
"value" : "These vulnerabilities were reported by JSC Positive Technologies (Vyacheslav Moskvin, Anton Dorfman, Sergey Fedonin, Ivan Kurnakov, Denis Goryushev). Coordination done by CERT@VDE."
}
] ,
"data_format" : "MITRE" ,
"data_type" : "CVE" ,
"data_version" : "4.0" ,
2020-12-17 22:03:03 +00:00
"description" : {
"description_data" : [
{
"lang" : "eng" ,
2021-05-21 08:57:17 +02:00
"value" : "On WAGO PFC200 devices in different firmware versions with special crafted packets an authorised attacker with network access to the device can access the file system with higher privileges."
2020-12-17 22:03:03 +00:00
}
]
2021-05-21 08:57:17 +02:00
} ,
"generator" : {
"engine" : "Vulnogram 0.0.9"
} ,
"impact" : {
"cvss" : {
"attackComplexity" : "LOW" ,
"attackVector" : "NETWORK" ,
"availabilityImpact" : "HIGH" ,
"baseScore" : 9.1 ,
"baseSeverity" : "CRITICAL" ,
"confidentialityImpact" : "HIGH" ,
"integrityImpact" : "HIGH" ,
"privilegesRequired" : "HIGH" ,
"scope" : "CHANGED" ,
"userInteraction" : "NONE" ,
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" ,
"version" : "3.1"
}
} ,
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng" ,
"value" : "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
}
]
}
]
} ,
"references" : {
"reference_data" : [
{
"name" : "https://cert.vde.com/en-us/advisories/vde-2021-014" ,
"refsource" : "CONFIRM" ,
"url" : "https://cert.vde.com/en-us/advisories/vde-2021-014"
}
]
} ,
"solution" : [
{
"lang" : "eng" ,
"value" : "WAGO recommends all effected users with CODESYS 2.3 Runtime PLCs to update to the firmware versions listed at https://cert.vde.com/en-us/advisories/vde-2021-014 in the solution paragraph."
}
] ,
"source" : {
"advisory" : "VDE-2021-014" ,
"defect" : [
"VDE-2021-014"
] ,
"discovery" : "EXTERNAL"
} ,
"work_around" : [
{
"lang" : "eng" ,
"value" : "Use general security best practices to protect systems from local and network attacks.\nDo not allow direct access to the device from untrusted networks.\nUpdate to the latest firmware according to the table in chapter solutions."
}
]
2020-12-17 22:03:03 +00:00
}
