cnvd - cnvd-2021-34728

CNVD-2021-34728

Vulnerability from cnvd - Published: 2021-05-16

Title

WAGO跨站脚本漏洞

Description

WAGO是德国万可（WAGO）的一款750-88x系列可编程逻辑控制器。该设备专门为在工业环境下应用而设计的数字运算操作电子系统。 WAGO存在跨站脚本漏洞。该漏洞源于WEB应用缺少对客户端数据的正确验证。攻击者可能诱骗合法用户单击链接，将恶意代码注入Web服务中。

Severity

高

Patch Name

WAGO跨站脚本漏洞的补丁

Patch Description

WAGO是德国万可（WAGO）的一款750-88x系列可编程逻辑控制器。该设备专门为在工业环境下应用而设计的数字运算操作电子系统。 WAGO存在跨站脚本漏洞。该漏洞源于WEB应用缺少对客户端数据的正确验证。攻击者可能诱骗合法用户单击链接，将恶意代码注入Web服务中。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://wago.io/

Reference

https://cert.vde.com/en-us/advisories/vde-2021-013

Impacted products

Name
WAGO WAGO null

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-20994",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-20994"
    }
  },
  "description": "WAGO\u662f\u5fb7\u56fd\u4e07\u53ef\uff08WAGO\uff09\u7684\u4e00\u6b3e750-88x\u7cfb\u5217\u53ef\u7f16\u7a0b\u903b\u8f91\u63a7\u5236\u5668\u3002\u8be5\u8bbe\u5907\u4e13\u95e8\u4e3a\u5728\u5de5\u4e1a\u73af\u5883\u4e0b\u5e94\u7528\u800c\u8bbe\u8ba1\u7684\u6570\u5b57\u8fd0\u7b97\u64cd\u4f5c\u7535\u5b50\u7cfb\u7edf\u3002\n\nWAGO\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8eWEB\u5e94\u7528\u7f3a\u5c11\u5bf9\u5ba2\u6237\u7aef\u6570\u636e\u7684\u6b63\u786e\u9a8c\u8bc1\u3002\u653b\u51fb\u8005\u53ef\u80fd\u8bf1\u9a97\u5408\u6cd5\u7528\u6237\u5355\u51fb\u94fe\u63a5\uff0c\u5c06\u6076\u610f\u4ee3\u7801\u6ce8\u5165Web\u670d\u52a1\u4e2d\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://wago.io/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-34728",
  "openTime": "2021-05-16",
  "patchDescription": "WAGO\u662f\u5fb7\u56fd\u4e07\u53ef\uff08WAGO\uff09\u7684\u4e00\u6b3e750-88x\u7cfb\u5217\u53ef\u7f16\u7a0b\u903b\u8f91\u63a7\u5236\u5668\u3002\u8be5\u8bbe\u5907\u4e13\u95e8\u4e3a\u5728\u5de5\u4e1a\u73af\u5883\u4e0b\u5e94\u7528\u800c\u8bbe\u8ba1\u7684\u6570\u5b57\u8fd0\u7b97\u64cd\u4f5c\u7535\u5b50\u7cfb\u7edf\u3002\r\n\r\nWAGO\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8eWEB\u5e94\u7528\u7f3a\u5c11\u5bf9\u5ba2\u6237\u7aef\u6570\u636e\u7684\u6b63\u786e\u9a8c\u8bc1\u3002\u653b\u51fb\u8005\u53ef\u80fd\u8bf1\u9a97\u5408\u6cd5\u7528\u6237\u5355\u51fb\u94fe\u63a5\uff0c\u5c06\u6076\u610f\u4ee3\u7801\u6ce8\u5165Web\u670d\u52a1\u4e2d\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "WAGO\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "WAGO WAGO null"
  },
  "referenceLink": "https://cert.vde.com/en-us/advisories/vde-2021-013",
  "serverity": "\u9ad8",
  "submitTime": "2021-05-14",
  "title": "WAGO\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e"
}

CVE-2021-20994 (GCVE-0-2021-20994)

Vulnerability from cvelistv5 – Published: 2021-05-13 13:45 – Updated: 2024-09-17 01:16

Title

WAGO: Managed Switches: Reflected Cross-site Scripting

Summary

In multiple managed switches by WAGO in different versions an attacker may trick a legitimate user to click a link to inject possible malicious code into the Web-Based Management.

Severity ?

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-79 - Cross-site Scripting (XSS)

Assigner

CERTVDE

References

URL

Tags

https://cert.vde.com/en-us/advisories/vde-2021-013

x_refsource_CONFIRM

Impacted products

Vendor

Product

Version

WAGO

0852-0303

Affected: unspecified , ≤ V1.2.3.S0 (custom)

WAGO	0852-1305	Affected: unspecified , ≤ V1.1.7.S0 (custom)
WAGO	0852-1505	Affected: unspecified , ≤ V1.1.6.S0 (custom)
WAGO	0852-1305/000-001	Affected: unspecified , ≤ V1.0.4.S0 (custom)
WAGO	0852-1505/000-001	Affected: unspecified , ≤ V1.0.4.S0 (custom)

Credits

Dr. Tobias Augustin and Stephan Tigges of IKS – Institut für Kooperative Systeme GmbH, Kai Gaul and Jan Rübenach of ABO Wind AG, coordinated by CERT@VDE

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:53:23.102Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert.vde.com/en-us/advisories/vde-2021-013"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "0852-0303",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThanOrEqual": "V1.2.3.S0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "0852-1305",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThanOrEqual": "V1.1.7.S0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "0852-1505",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThanOrEqual": "V1.1.6.S0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "0852-1305/000-001",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThanOrEqual": "V1.0.4.S0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "0852-1505/000-001",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThanOrEqual": "V1.0.4.S0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Dr. Tobias Augustin and Stephan Tigges of IKS \u2013 Institut f\u00fcr Kooperative Systeme GmbH, Kai Gaul and Jan R\u00fcbenach of ABO Wind AG, coordinated by CERT@VDE"
        }
      ],
      "datePublic": "2021-05-05T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "In multiple managed switches by WAGO in different versions an attacker may trick a legitimate user to click a link to inject possible malicious code into the Web-Based Management."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-05-13T13:45:24",
        "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
        "shortName": "CERTVDE"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert.vde.com/en-us/advisories/vde-2021-013"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "The Web-Based Management is only needed during installation and commissioning, not during normal operations. It is recommended to disable the web server after commissioning. The Command Line Interface (CLI) is an alternative for commissioning the device. This is the easiest and securest way to protect your device from the listed vulnerabilities.\n\nRegardless of the action described above, the vulnerabilities are fixed with following firmware releases:\nItem number [FW version]\n0852-0303 (HW \u003c 3)* [V1.2.5.S0] Detailed information about the hardware version is described in the installation guide.\n0852-0303 (HW \u003e=3)* [V1.2.3.S1] Detailed information about the hardware version is described in the installation guide.\n0852-1305 [V1.1.8.S0]\n0852-1505 [V1.1.7.S0]\n0852-1305/000-001 [V1.1.4.S0]\n0852-1505/000-001 [V1.1.4.S0]"
        }
      ],
      "source": {
        "advisory": "VDE-2021-013",
        "defect": [
          "VDE-2021-013"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "WAGO: Managed Switches: Reflected Cross-site Scripting",
      "workarounds": [
        {
          "lang": "en",
          "value": "Disable the web server of the device.\nUse the CLI interface of the device.\nUpdate to the latest firmware.\nRestrict network access to the device.\nDo not directly connect the device to the internet."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "info@cert.vde.com",
          "DATE_PUBLIC": "2021-05-05T10:00:00.000Z",
          "ID": "CVE-2021-20994",
          "STATE": "PUBLIC",
          "TITLE": "WAGO: Managed Switches: Reflected Cross-site Scripting"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "0852-0303",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "V1.2.3.S0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "0852-1305",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "V1.1.7.S0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "0852-1505",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "V1.1.6.S0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "0852-1305/000-001",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "V1.0.4.S0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "0852-1505/000-001",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "V1.0.4.S0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "WAGO"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Dr. Tobias Augustin and Stephan Tigges of IKS \u2013 Institut f\u00fcr Kooperative Systeme GmbH, Kai Gaul and Jan R\u00fcbenach of ABO Wind AG, coordinated by CERT@VDE"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In multiple managed switches by WAGO in different versions an attacker may trick a legitimate user to click a link to inject possible malicious code into the Web-Based Management."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Cross-site Scripting (XSS)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://cert.vde.com/en-us/advisories/vde-2021-013",
              "refsource": "CONFIRM",
              "url": "https://cert.vde.com/en-us/advisories/vde-2021-013"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "The Web-Based Management is only needed during installation and commissioning, not during normal operations. It is recommended to disable the web server after commissioning. The Command Line Interface (CLI) is an alternative for commissioning the device. This is the easiest and securest way to protect your device from the listed vulnerabilities.\n\nRegardless of the action described above, the vulnerabilities are fixed with following firmware releases:\nItem number [FW version]\n0852-0303 (HW \u003c 3)* [V1.2.5.S0] Detailed information about the hardware version is described in the installation guide.\n0852-0303 (HW \u003e=3)* [V1.2.3.S1] Detailed information about the hardware version is described in the installation guide.\n0852-1305 [V1.1.8.S0]\n0852-1505 [V1.1.7.S0]\n0852-1305/000-001 [V1.1.4.S0]\n0852-1505/000-001 [V1.1.4.S0]"
          }
        ],
        "source": {
          "advisory": "VDE-2021-013",
          "defect": [
            "VDE-2021-013"
          ],
          "discovery": "EXTERNAL"
        },
        "work_around": [
          {
            "lang": "en",
            "value": "Disable the web server of the device.\nUse the CLI interface of the device.\nUpdate to the latest firmware.\nRestrict network access to the device.\nDo not directly connect the device to the internet."
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
    "assignerShortName": "CERTVDE",
    "cveId": "CVE-2021-20994",
    "datePublished": "2021-05-13T13:45:24.684398Z",
    "dateReserved": "2020-12-17T00:00:00",
    "dateUpdated": "2024-09-17T01:16:25.472Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2021-34728

CVE-2021-20994 (GCVE-0-2021-20994)

Tags

Sightings

Nomenclature