CVE-2021-20997 - Vulnerability Details - OpenCVE

In multiple managed switches by WAGO in different versions it is possible to read out the password hashes of all Web-based Management users.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Wago	0852-0303 0852-0303 Firmware 0852-1305 0852-1305\/000-001 0852-1305\/000-001 Firmware 0852-1305 Firmware 0852-1505 0852-1505\/000-001 0852-1505\/000-001 Firmware 0852-1505 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:wago:0852-0303_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:wago:0852-0303:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:wago:0852-1305_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:wago:0852-1305:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:wago:0852-1505_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:wago:0852-1505:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:wago:0852-1305\/000-001_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:wago:0852-1305\/000-001:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:wago:0852-1505\/000-001_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:wago:0852-1505\/000-001:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://cert.vde.com/en-us/advisories/vde-2021-013

History

No history.

MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published: 2021-05-13T13:45:25.054592Z

Updated: 2024-09-16T23:42:19.095Z

Reserved: 2020-12-17T00:00:00

Link: CVE-2021-20997

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-05-13T14:15:18.077

Modified: 2024-11-21T05:47:22.233

Link: CVE-2021-20997

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "0852-0303", "vendor": "WAGO", "versions": [{"lessThanOrEqual": "V1.2.3.S0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "0852-1305", "vendor": "WAGO", "versions": [{"lessThanOrEqual": "V1.1.7.S0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "0852-1505", "vendor": "WAGO", "versions": [{"lessThanOrEqual": "V1.1.6.S0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "0852-1305/000-001", "vendor": "WAGO", "versions": [{"lessThanOrEqual": "V1.0.4.S0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "0852-1505/000-001", "vendor": "WAGO", "versions": [{"lessThanOrEqual": "V1.0.4.S0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Dr. Tobias Augustin and Stephan Tigges of IKS \u2013 Institut f\u00fcr Kooperative Systeme GmbH, Kai Gaul and Jan R\u00fcbenach of ABO Wind AG, coordinated by CERT@VDE"}], "datePublic": "2021-05-05T00:00:00", "descriptions": [{"lang": "en", "value": "In multiple managed switches by WAGO in different versions it is possible to read out the password hashes of all Web-based Management users."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-522", "description": "CWE-522 Insufficiently Protected Credentials", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-05-13T13:45:25", "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://cert.vde.com/en-us/advisories/vde-2021-013"}], "solutions": [{"lang": "en", "value": "The Web-Based Management is only needed during installation and commissioning, not during normal operations. It is recommended to disable the web server after commissioning. The Command Line Interface (CLI) is an alternative for commissioning the device. This is the easiest and securest way to protect your device from the listed vulnerabilities.\n\nRegardless of the action described above, the vulnerabilities are fixed with following firmware releases:\nItem number [FW version]\n0852-0303 (HW < 3)* [V1.2.5.S0] Detailed information about the hardware version is described in the installation guide.\n0852-0303 (HW >=3)* [V1.2.3.S1] Detailed information about the hardware version is described in the installation guide.\n0852-1305 [V1.1.8.S0]\n0852-1505 [V1.1.7.S0]\n0852-1305/000-001 [V1.1.4.S0]\n0852-1505/000-001 [V1.1.4.S0]"}], "source": {"advisory": "VDE-2021-013", "defect": ["VDE-2021-013"], "discovery": "EXTERNAL"}, "title": "WAGO: Managed Switches: Unauthorized access to password hashes", "workarounds": [{"lang": "en", "value": "Disable the web server of the device.\nUse the CLI interface of the device.\nUpdate to the latest firmware.\nRestrict network access to the device.\nDo not directly connect the device to the internet."}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "info@cert.vde.com", "DATE_PUBLIC": "2021-05-05T10:00:00.000Z", "ID": "CVE-2021-20997", "STATE": "PUBLIC", "TITLE": "WAGO: Managed Switches: Unauthorized access to password hashes"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "0852-0303", "version": {"version_data": [{"version_affected": "<=", "version_value": "V1.2.3.S0"}]}}, {"product_name": "0852-1305", "version": {"version_data": [{"version_affected": "<=", "version_value": "V1.1.7.S0"}]}}, {"product_name": "0852-1505", "version": {"version_data": [{"version_affected": "<=", "version_value": "V1.1.6.S0"}]}}, {"product_name": "0852-1305/000-001", "version": {"version_data": [{"version_affected": "<=", "version_value": "V1.0.4.S0"}]}}, {"product_name": "0852-1505/000-001", "version": {"version_data": [{"version_affected": "<=", "version_value": "V1.0.4.S0"}]}}]}, "vendor_name": "WAGO"}]}}, "credit": [{"lang": "eng", "value": "Dr. Tobias Augustin and Stephan Tigges of IKS \u2013 Institut f\u00fcr Kooperative Systeme GmbH, Kai Gaul and Jan R\u00fcbenach of ABO Wind AG, coordinated by CERT@VDE"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In multiple managed switches by WAGO in different versions it is possible to read out the password hashes of all Web-based Management users."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-522 Insufficiently Protected Credentials"}]}]}, "references": {"reference_data": [{"name": "https://cert.vde.com/en-us/advisories/vde-2021-013", "refsource": "CONFIRM", "url": "https://cert.vde.com/en-us/advisories/vde-2021-013"}]}, "solution": [{"lang": "en", "value": "The Web-Based Management is only needed during installation and commissioning, not during normal operations. It is recommended to disable the web server after commissioning. The Command Line Interface (CLI) is an alternative for commissioning the device. This is the easiest and securest way to protect your device from the listed vulnerabilities.\n\nRegardless of the action described above, the vulnerabilities are fixed with following firmware releases:\nItem number [FW version]\n0852-0303 (HW < 3)* [V1.2.5.S0] Detailed information about the hardware version is described in the installation guide.\n0852-0303 (HW >=3)* [V1.2.3.S1] Detailed information about the hardware version is described in the installation guide.\n0852-1305 [V1.1.8.S0]\n0852-1505 [V1.1.7.S0]\n0852-1305/000-001 [V1.1.4.S0]\n0852-1505/000-001 [V1.1.4.S0]"}], "source": {"advisory": "VDE-2021-013", "defect": ["VDE-2021-013"], "discovery": "EXTERNAL"}, "work_around": [{"lang": "en", "value": "Disable the web server of the device.\nUse the CLI interface of the device.\nUpdate to the latest firmware.\nRestrict network access to the device.\nDo not directly connect the device to the internet."}]}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T17:53:23.188Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://cert.vde.com/en-us/advisories/vde-2021-013"}]}]}, "cveMetadata": {"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "assignerShortName": "CERTVDE", "cveId": "CVE-2021-20997", "datePublished": "2021-05-13T13:45:25.054592Z", "dateReserved": "2020-12-17T00:00:00", "dateUpdated": "2024-09-16T23:42:19.095Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:wago:0852-0303_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "F5CF4A95-5671-4AA5-8F27-B16A681AE82E", "versionEndIncluding": "1.2.3.s0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:wago:0852-0303:-:*:*:*:*:*:*:*", "matchCriteriaId": "3611D06D-0A64-4817-9142-5F8B9B3CB763", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:wago:0852-1305_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "A48F91CD-922D-4E76-AC7A-E132F9E26A79", "versionEndIncluding": "1.1.7.s0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:wago:0852-1305:-:*:*:*:*:*:*:*", "matchCriteriaId": "9FEC92F0-ED21-4BF9-AC9A-424EE913A6E7", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:wago:0852-1505_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "BDF3F15D-6BF7-4C47-8552-9A9275FD5066", "versionEndIncluding": "1.1.6.s0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:wago:0852-1505:-:*:*:*:*:*:*:*", "matchCriteriaId": "991752B3-8BE0-4D10-9240-51B0E4050358", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:wago:0852-1305\\/000-001_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "2BF24302-7E5C-41D7-AB57-064B94D7AF00", "versionEndIncluding": "1.0.4.s0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:wago:0852-1305\\/000-001:-:*:*:*:*:*:*:*", "matchCriteriaId": "9A91A50A-2BBB-4667-8764-C3D6C7717C3B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:wago:0852-1505\\/000-001_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "A28B4348-CA65-406A-BDD7-748E5ED9C2B2", "versionEndIncluding": "1.0.4.s0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:wago:0852-1505\\/000-001:-:*:*:*:*:*:*:*", "matchCriteriaId": "F7F57D47-2310-4389-BE4C-7545A7DB8C07", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "In multiple managed switches by WAGO in different versions it is possible to read out the password hashes of all Web-based Management users."}, {"lang": "es", "value": "En m\u00faltiples switches administrados por WAGO en diferentes versiones, es posible leer los hashes de contrase\u00f1a de todos los usuarios de Administraci\u00f3n basada en Web"}], "id": "CVE-2021-20997", "lastModified": "2024-11-21T05:47:22.233", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "info@cert.vde.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-05-13T14:15:18.077", "references": [{"source": "info@cert.vde.com", "tags": ["Third Party Advisory"], "url": "https://cert.vde.com/en-us/advisories/vde-2021-013"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://cert.vde.com/en-us/advisories/vde-2021-013"}], "sourceIdentifier": "info@cert.vde.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "info@cert.vde.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-522"}], "source": "nvd@nist.gov", "type": "Primary"}]}