CVE-2021-20994

{"containers": {"cna": {"affected": [{"product": "0852-0303", "vendor": "WAGO", "versions": [{"lessThanOrEqual": "V1.2.3.S0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "0852-1305", "vendor": "WAGO", "versions": [{"lessThanOrEqual": "V1.1.7.S0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "0852-1505", "vendor": "WAGO", "versions": [{"lessThanOrEqual": "V1.1.6.S0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "0852-1305/000-001", "vendor": "WAGO", "versions": [{"lessThanOrEqual": "V1.0.4.S0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "0852-1505/000-001", "vendor": "WAGO", "versions": [{"lessThanOrEqual": "V1.0.4.S0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Dr. Tobias Augustin and Stephan Tigges of IKS \u2013 Institut f\u00fcr Kooperative Systeme GmbH, Kai Gaul and Jan R\u00fcbenach of ABO Wind AG, coordinated by CERT@VDE"}], "datePublic": "2021-05-05T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "In multiple managed switches by WAGO in different versions an attacker may trick a legitimate user to click a link to inject possible malicious code into the Web-Based Management."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Cross-site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-05-13T13:45:24.000Z", "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://cert.vde.com/en-us/advisories/vde-2021-013"}], "solutions": [{"lang": "en", "value": "The Web-Based Management is only needed during installation and commissioning, not during normal operations. It is recommended to disable the web server after commissioning. The Command Line Interface (CLI) is an alternative for commissioning the device. This is the easiest and securest way to protect your device from the listed vulnerabilities.\n\nRegardless of the action described above, the vulnerabilities are fixed with following firmware releases:\nItem number [FW version]\n0852-0303 (HW < 3)* [V1.2.5.S0] Detailed information about the hardware version is described in the installation guide.\n0852-0303 (HW >=3)* [V1.2.3.S1] Detailed information about the hardware version is described in the installation guide.\n0852-1305 [V1.1.8.S0]\n0852-1505 [V1.1.7.S0]\n0852-1305/000-001 [V1.1.4.S0]\n0852-1505/000-001 [V1.1.4.S0]"}], "source": {"advisory": "VDE-2021-013", "defect": ["VDE-2021-013"], "discovery": "EXTERNAL"}, "title": "WAGO: Managed Switches: Reflected Cross-site Scripting", "workarounds": [{"lang": "en", "value": "Disable the web server of the device.\nUse the CLI interface of the device.\nUpdate to the latest firmware.\nRestrict network access to the device.\nDo not directly connect the device to the internet."}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "info@cert.vde.com", "DATE_PUBLIC": "2021-05-05T10:00:00.000Z", "ID": "CVE-2021-20994", "STATE": "PUBLIC", "TITLE": "WAGO: Managed Switches: Reflected Cross-site Scripting"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "0852-0303", "version": {"version_data": [{"version_affected": "<=", "version_value": "V1.2.3.S0"}]}}, {"product_name": "0852-1305", "version": {"version_data": [{"version_affected": "<=", "version_value": "V1.1.7.S0"}]}}, {"product_name": "0852-1505", "version": {"version_data": [{"version_affected": "<=", "version_value": "V1.1.6.S0"}]}}, {"product_name": "0852-1305/000-001", "version": {"version_data": [{"version_affected": "<=", "version_value": "V1.0.4.S0"}]}}, {"product_name": "0852-1505/000-001", "version": {"version_data": [{"version_affected": "<=", "version_value": "V1.0.4.S0"}]}}]}, "vendor_name": "WAGO"}]}}, "credit": [{"lang": "eng", "value": "Dr. Tobias Augustin and Stephan Tigges of IKS \u2013 Institut f\u00fcr Kooperative Systeme GmbH, Kai Gaul and Jan R\u00fcbenach of ABO Wind AG, coordinated by CERT@VDE"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In multiple managed switches by WAGO in different versions an attacker may trick a legitimate user to click a link to inject possible malicious code into the Web-Based Management."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79 Cross-site Scripting (XSS)"}]}]}, "references": {"reference_data": [{"name": "https://cert.vde.com/en-us/advisories/vde-2021-013", "refsource": "CONFIRM", "url": "https://cert.vde.com/en-us/advisories/vde-2021-013"}]}, "solution": [{"lang": "en", "value": "The Web-Based Management is only needed during installation and commissioning, not during normal operations. It is recommended to disable the web server after commissioning. The Command Line Interface (CLI) is an alternative for commissioning the device. This is the easiest and securest way to protect your device from the listed vulnerabilities.\n\nRegardless of the action described above, the vulnerabilities are fixed with following firmware releases:\nItem number [FW version]\n0852-0303 (HW < 3)* [V1.2.5.S0] Detailed information about the hardware version is described in the installation guide.\n0852-0303 (HW >=3)* [V1.2.3.S1] Detailed information about the hardware version is described in the installation guide.\n0852-1305 [V1.1.8.S0]\n0852-1505 [V1.1.7.S0]\n0852-1305/000-001 [V1.1.4.S0]\n0852-1505/000-001 [V1.1.4.S0]"}], "source": {"advisory": "VDE-2021-013", "defect": ["VDE-2021-013"], "discovery": "EXTERNAL"}, "work_around": [{"lang": "en", "value": "Disable the web server of the device.\nUse the CLI interface of the device.\nUpdate to the latest firmware.\nRestrict network access to the device.\nDo not directly connect the device to the internet."}]}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T17:53:23.102Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://cert.vde.com/en-us/advisories/vde-2021-013"}]}]}, "cveMetadata": {"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "assignerShortName": "CERTVDE", "cveId": "CVE-2021-20994", "datePublished": "2021-05-13T13:45:24.684Z", "dateReserved": "2020-12-17T00:00:00.000Z", "dateUpdated": "2024-09-17T01:16:25.472Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "0852-0303", "vendor": "WAGO", "versions": [{"lessThanOrEqual": "V1.2.3.S0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "0852-1305", "vendor": "WAGO", "versions": [{"lessThanOrEqual": "V1.1.7.S0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "0852-1505", "vendor": "WAGO", "versions": [{"lessThanOrEqual": "V1.1.6.S0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "0852-1305/000-001", "vendor": "WAGO", "versions": [{"lessThanOrEqual": "V1.0.4.S0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "0852-1505/000-001", "vendor": "WAGO", "versions": [{"lessThanOrEqual": "V1.0.4.S0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "source": "info@cert.vde.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:wago:0852-0303_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "F5CF4A95-5671-4AA5-8F27-B16A681AE82E", "versionEndIncluding": "1.2.3.s0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:wago:0852-0303:-:*:*:*:*:*:*:*", "matchCriteriaId": "3611D06D-0A64-4817-9142-5F8B9B3CB763", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:wago:0852-1305_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "A48F91CD-922D-4E76-AC7A-E132F9E26A79", "versionEndIncluding": "1.1.7.s0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:wago:0852-1305:-:*:*:*:*:*:*:*", "matchCriteriaId": "9FEC92F0-ED21-4BF9-AC9A-424EE913A6E7", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:wago:0852-1505_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "BDF3F15D-6BF7-4C47-8552-9A9275FD5066", "versionEndIncluding": "1.1.6.s0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:wago:0852-1505:-:*:*:*:*:*:*:*", "matchCriteriaId": "991752B3-8BE0-4D10-9240-51B0E4050358", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:wago:0852-1305\\/000-001_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "2BF24302-7E5C-41D7-AB57-064B94D7AF00", "versionEndIncluding": "1.0.4.s0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:wago:0852-1305\\/000-001:-:*:*:*:*:*:*:*", "matchCriteriaId": "9A91A50A-2BBB-4667-8764-C3D6C7717C3B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:wago:0852-1505\\/000-001_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "A28B4348-CA65-406A-BDD7-748E5ED9C2B2", "versionEndIncluding": "1.0.4.s0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:wago:0852-1505\\/000-001:-:*:*:*:*:*:*:*", "matchCriteriaId": "F7F57D47-2310-4389-BE4C-7545A7DB8C07", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In multiple managed switches by WAGO in different versions an attacker may trick a legitimate user to click a link to inject possible malicious code into the Web-Based Management."}, {"lang": "es", "value": "En m\u00faltiples switches administrados por WAGO en diferentes versiones, un atacante puede enga\u00f1ar a un usuario leg\u00edtimo para que haga clic en un enlace para inyectar un posible c\u00f3digo malicioso en la Administraci\u00f3n Basada en Web"}], "id": "CVE-2021-20994", "lastModified": "2026-06-17T03:34:37.087", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "info@cert.vde.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-05-13T14:15:17.970", "references": [{"source": "info@cert.vde.com", "tags": ["Third Party Advisory"], "url": "https://cert.vde.com/en-us/advisories/vde-2021-013"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://cert.vde.com/en-us/advisories/vde-2021-013"}], "sourceIdentifier": "info@cert.vde.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "info@cert.vde.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}