Vulnerability · Published Aug 31, 2021 · Assigned by CERTVDE

CVE-2021-34578WAGO: Authentication Vulnerability in Web-Based Management

Critical 9.8

In plain English

A critical-severity improper authentication in PLC from WAGO. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.0%top 38.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically constructed requests without authentication on multiple WAGO PLCs in firmware versions up to FW07.

Affected products (as reported)

Vendor	Product	Versions
WAGO	PLC	750-362 – through FW07750-363 – through FW07750-823 – through FW07750-832/xxx-xxx – through FW07750-862 – through FW07750-891 – through FW07750-890/xxx-xxx – through FW07750-893 – through FW07

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://cert.vde.com/en-us/advisories/vde-2020-044 x_refsource_CONFIRM