CVE-2021-34578: WAGO PLC, заобикаляне на вход и права

Описание

Оригинално описание

This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically constructed requests without authentication on multiple WAGO PLCs in firmware versions up to FW07.

Засегнати продукти

• WAGO PLC: 750-362 до FW07; 750-363 до FW07; 750-823 до FW07; 750-832/xxx-xxx до FW07; 750-862 до FW07; 750-891 до FW07; 750-890/xxx-xxx до FW07; 750-893 до FW07

Вид слабост

• CWE-287 Неправилна автентикация

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2021-34578
• https://nvd.nist.gov/vuln/detail/CVE-2021-34578
• https://cert.vde.com/en-us/advisories/vde-2020-044