CVE-2021-20998: WAGO 0852-0303, заобикаляне на вход и права

Описание

Оригинално описание

In multiple managed switches by WAGO in different versions without authorization and with specially crafted packets it is possible to create users.

Засегнати продукти

• WAGO 0852-0303: unspecified до V1.2.3.S0
• WAGO 0852-1305: unspecified до V1.1.7.S0
• WAGO 0852-1505: unspecified до V1.1.6.S0
• WAGO 0852-1305/000-001: unspecified до V1.0.4.S0
• WAGO 0852-1505/000-001: unspecified до V1.0.4.S0

Вид слабост

• CWE-306 Липсваща автентикация за критична функционалност

История

Други уязвимости в WAGO 0852-0303

• 7.5CVE-2021-20997
• 5.3CVE-2021-20996
• 5.3CVE-2021-20995
• 8.8CVE-2021-20994
• 5.3CVE-2021-20993

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2021-20998
• https://nvd.nist.gov/vuln/detail/CVE-2021-20998
• https://cert.vde.com/en-us/advisories/vde-2021-013