CVE-2021-21001: WAGO Series PFC200 Controller, обхождане на път

Описание

Оригинално описание

On WAGO PFC200 devices in different firmware versions with special crafted packets an authorised attacker with network access to the device can access the file system with higher privileges.

Засегнати продукти

• WAGO Series PFC200 Controller: 750-823 до FW07; 750-829 до FW14; 750-831/000-00x до FW14; 750-832/000-00x до FW06; 750-852 до FW14; 750-862 до FW07; 750-880/0xx-xxx до FW15; 750-881 до FW14; 750-882 до FW14; 750-885/0xx-xxx до FW14; 750-889 до FW14; 750-890/0xx-xxx до FW07; 750-891 до FW07; 750-893 до FW07
• WAGO Series Ethernet Controller: 750-8202/xxx-xxx преди 03.06.19 (18); 750-8203/xxx-xxx преди 03.06.19 (18); 750-8204/xxx-xxx преди 03.06.19 (18); 750-8206/xxx-xxx преди 03.06.19 (18); 750-8207/xxx-xxx преди 03.06.19 (18); 750-8208/xxx-xxx преди 03.06.19 (18); 750-8210/xxx-xxx преди 03.06.19 (18); 750-8211/xxx-xxx преди 03.06.19 (18); 750-8212/xxx-xxx преди 03.06.19 (18); 750-8213/xxx-xxx преди 03.06.19 (18); 750-8214/xxx-xxx преди 03.06.19 (18); 750-8216/xxx-xxx преди 03.06.19 (18); 750-8217/xxx-xxx преди 03.06.19 (18)

Вид слабост

• CWE-22 Неправилно ограничаване на път до позволена директория

История

Други уязвимости в WAGO Series PFC200 Controller

• 5.3CVE-2021-21000

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2021-21001
• https://nvd.nist.gov/vuln/detail/CVE-2021-21001
• https://cert.vde.com/en-us/advisories/vde-2021-014