CVE-2021-20998 (GCVE-0-2021-20998)

Vulnerability from cvelistv5 – Published: 2021-05-13 13:45 – Updated: 2024-09-17 00:51
VLAI?
Title
WAGO: Managed Switches: Unauthorized creation of user accounts
Summary
In multiple managed switches by WAGO in different versions without authorization and with specially crafted packets it is possible to create users.
Severity ?
10 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE
  • CWE-306 - Missing Authentication for Critical Function
Assigner
References
Impacted products
Vendor Product Version
WAGO 0852-0303 Affected: unspecified , ≤ V1.2.3.S0 (custom)
Create a notification for this product.
    WAGO 0852-1305 Affected: unspecified , ≤ V1.1.7.S0 (custom)
Create a notification for this product.
    WAGO 0852-1505 Affected: unspecified , ≤ V1.1.6.S0 (custom)
Create a notification for this product.
    WAGO 0852-1305/000-001 Affected: unspecified , ≤ V1.0.4.S0 (custom)
Create a notification for this product.
    WAGO 0852-1505/000-001 Affected: unspecified , ≤ V1.0.4.S0 (custom)
Create a notification for this product.
Credits
Dr. Tobias Augustin and Stephan Tigges of IKS – Institut für Kooperative Systeme GmbH, Kai Gaul and Jan Rübenach of ABO Wind AG, coordinated by CERT@VDE
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:53:23.122Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert.vde.com/en-us/advisories/vde-2021-013"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "0852-0303",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThanOrEqual": "V1.2.3.S0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "0852-1305",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThanOrEqual": "V1.1.7.S0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "0852-1505",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThanOrEqual": "V1.1.6.S0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "0852-1305/000-001",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThanOrEqual": "V1.0.4.S0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "0852-1505/000-001",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThanOrEqual": "V1.0.4.S0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Dr. Tobias Augustin and Stephan Tigges of IKS \u2013 Institut f\u00fcr Kooperative Systeme GmbH, Kai Gaul and Jan R\u00fcbenach of ABO Wind AG, coordinated by CERT@VDE"
        }
      ],
      "datePublic": "2021-05-05T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "In multiple managed switches by WAGO in different versions without authorization and with specially crafted packets it is possible to create users."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306 Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-05-13T13:45:25",
        "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
        "shortName": "CERTVDE"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert.vde.com/en-us/advisories/vde-2021-013"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "The Web-Based Management is only needed during installation and commissioning, not during normal operations. It is recommended to disable the web server after commissioning. The Command Line Interface (CLI) is an alternative for commissioning the device. This is the easiest and securest way to protect your device from the listed vulnerabilities.\n\nRegardless of the action described above, the vulnerabilities are fixed with following firmware releases:\nItem number [FW version]\n0852-0303 (HW \u003c 3)* [V1.2.5.S0] Detailed information about the hardware version is described in the installation guide.\n0852-0303 (HW \u003e=3)* [V1.2.3.S1] Detailed information about the hardware version is described in the installation guide.\n0852-1305 [V1.1.8.S0]\n0852-1505 [V1.1.7.S0]\n0852-1305/000-001 [V1.1.4.S0]\n0852-1505/000-001 [V1.1.4.S0]"
        }
      ],
      "source": {
        "advisory": "VDE-2021-013",
        "defect": [
          "VDE-2021-013"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "WAGO: Managed Switches: Unauthorized creation of user accounts",
      "workarounds": [
        {
          "lang": "en",
          "value": "Disable the web server of the device.\nUse the CLI interface of the device.\nUpdate to the latest firmware.\nRestrict network access to the device.\nDo not directly connect the device to the internet."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "info@cert.vde.com",
          "DATE_PUBLIC": "2021-05-05T10:00:00.000Z",
          "ID": "CVE-2021-20998",
          "STATE": "PUBLIC",
          "TITLE": "WAGO: Managed Switches: Unauthorized creation of user accounts"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "0852-0303",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "V1.2.3.S0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "0852-1305",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "V1.1.7.S0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "0852-1505",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "V1.1.6.S0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "0852-1305/000-001",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "V1.0.4.S0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "0852-1505/000-001",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "V1.0.4.S0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "WAGO"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Dr. Tobias Augustin and Stephan Tigges of IKS \u2013 Institut f\u00fcr Kooperative Systeme GmbH, Kai Gaul and Jan R\u00fcbenach of ABO Wind AG, coordinated by CERT@VDE"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In multiple managed switches by WAGO in different versions without authorization and with specially crafted packets it is possible to create users."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-306 Missing Authentication for Critical Function"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://cert.vde.com/en-us/advisories/vde-2021-013",
              "refsource": "CONFIRM",
              "url": "https://cert.vde.com/en-us/advisories/vde-2021-013"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "The Web-Based Management is only needed during installation and commissioning, not during normal operations. It is recommended to disable the web server after commissioning. The Command Line Interface (CLI) is an alternative for commissioning the device. This is the easiest and securest way to protect your device from the listed vulnerabilities.\n\nRegardless of the action described above, the vulnerabilities are fixed with following firmware releases:\nItem number [FW version]\n0852-0303 (HW \u003c 3)* [V1.2.5.S0] Detailed information about the hardware version is described in the installation guide.\n0852-0303 (HW \u003e=3)* [V1.2.3.S1] Detailed information about the hardware version is described in the installation guide.\n0852-1305 [V1.1.8.S0]\n0852-1505 [V1.1.7.S0]\n0852-1305/000-001 [V1.1.4.S0]\n0852-1505/000-001 [V1.1.4.S0]"
          }
        ],
        "source": {
          "advisory": "VDE-2021-013",
          "defect": [
            "VDE-2021-013"
          ],
          "discovery": "EXTERNAL"
        },
        "work_around": [
          {
            "lang": "en",
            "value": "Disable the web server of the device.\nUse the CLI interface of the device.\nUpdate to the latest firmware.\nRestrict network access to the device.\nDo not directly connect the device to the internet."
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
    "assignerShortName": "CERTVDE",
    "cveId": "CVE-2021-20998",
    "datePublished": "2021-05-13T13:45:25.179394Z",
    "dateReserved": "2020-12-17T00:00:00",
    "dateUpdated": "2024-09-17T00:51:42.120Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:wago:0852-0303_firmware:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"1.2.3.s0\", \"matchCriteriaId\": \"F5CF4A95-5671-4AA5-8F27-B16A681AE82E\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:wago:0852-0303:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3611D06D-0A64-4817-9142-5F8B9B3CB763\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:wago:0852-1305_firmware:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"1.1.7.s0\", \"matchCriteriaId\": \"A48F91CD-922D-4E76-AC7A-E132F9E26A79\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:wago:0852-1305:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9FEC92F0-ED21-4BF9-AC9A-424EE913A6E7\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:wago:0852-1505_firmware:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"1.1.6.s0\", \"matchCriteriaId\": \"BDF3F15D-6BF7-4C47-8552-9A9275FD5066\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:wago:0852-1505:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"991752B3-8BE0-4D10-9240-51B0E4050358\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:wago:0852-1305\\\\/000-001_firmware:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"1.0.4.s0\", \"matchCriteriaId\": \"2BF24302-7E5C-41D7-AB57-064B94D7AF00\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:wago:0852-1305\\\\/000-001:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9A91A50A-2BBB-4667-8764-C3D6C7717C3B\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:wago:0852-1505\\\\/000-001_firmware:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"1.0.4.s0\", \"matchCriteriaId\": \"A28B4348-CA65-406A-BDD7-748E5ED9C2B2\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:wago:0852-1505\\\\/000-001:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F7F57D47-2310-4389-BE4C-7545A7DB8C07\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In multiple managed switches by WAGO in different versions without authorization and with specially crafted packets it is possible to create users.\"}, {\"lang\": \"es\", \"value\": \"En m\\u00faltiples switches administrados por WAGO en diferentes versiones sin autorizaci\\u00f3n y con paquetes especialmente dise\\u00f1ados es posible crear usuarios\"}]",
      "id": "CVE-2021-20998",
      "lastModified": "2024-11-21T05:47:22.347",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"info@cert.vde.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"baseScore\": 10.0, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 6.0}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:P/I:P/A:P\", \"baseScore\": 7.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 10.0, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2021-05-13T14:15:18.113",
      "references": "[{\"url\": \"https://cert.vde.com/en-us/advisories/vde-2021-013\", \"source\": \"info@cert.vde.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://cert.vde.com/en-us/advisories/vde-2021-013\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
      "sourceIdentifier": "info@cert.vde.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"info@cert.vde.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-306\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-306\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-20998\",\"sourceIdentifier\":\"info@cert.vde.com\",\"published\":\"2021-05-13T14:15:18.113\",\"lastModified\":\"2024-11-21T05:47:22.347\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In multiple managed switches by WAGO in different versions without authorization and with specially crafted packets it is possible to create users.\"},{\"lang\":\"es\",\"value\":\"En m\u00faltiples switches administrados por WAGO en diferentes versiones sin autorizaci\u00f3n y con paquetes especialmente dise\u00f1ados es posible crear usuarios\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"info@cert.vde.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":10.0,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"info@cert.vde.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-306\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-306\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:wago:0852-0303_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.2.3.s0\",\"matchCriteriaId\":\"F5CF4A95-5671-4AA5-8F27-B16A681AE82E\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:wago:0852-0303:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3611D06D-0A64-4817-9142-5F8B9B3CB763\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:wago:0852-1305_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.1.7.s0\",\"matchCriteriaId\":\"A48F91CD-922D-4E76-AC7A-E132F9E26A79\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:wago:0852-1305:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9FEC92F0-ED21-4BF9-AC9A-424EE913A6E7\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:wago:0852-1505_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.1.6.s0\",\"matchCriteriaId\":\"BDF3F15D-6BF7-4C47-8552-9A9275FD5066\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:wago:0852-1505:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"991752B3-8BE0-4D10-9240-51B0E4050358\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:wago:0852-1305\\\\/000-001_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.0.4.s0\",\"matchCriteriaId\":\"2BF24302-7E5C-41D7-AB57-064B94D7AF00\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:wago:0852-1305\\\\/000-001:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9A91A50A-2BBB-4667-8764-C3D6C7717C3B\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:wago:0852-1505\\\\/000-001_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.0.4.s0\",\"matchCriteriaId\":\"A28B4348-CA65-406A-BDD7-748E5ED9C2B2\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:wago:0852-1505\\\\/000-001:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F7F57D47-2310-4389-BE4C-7545A7DB8C07\"}]}]}],\"references\":[{\"url\":\"https://cert.vde.com/en-us/advisories/vde-2021-013\",\"source\":\"info@cert.vde.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://cert.vde.com/en-us/advisories/vde-2021-013\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.