What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2021-21001.

What is the severity of CVE-2021-21001?

The severity of CVE-2021-21001 is critical with a severity value of 6.5.

Which devices are affected by CVE-2021-21001?

WAGO PFC200 devices in different firmware versions are affected by CVE-2021-21001.

How can an attacker exploit CVE-2021-21001?

An authorized attacker with network access to the WAGO PFC200 device can exploit CVE-2021-21001 by using specially crafted packets to access the file system with higher privileges.

Is there a fix available for CVE-2021-21001?

It is recommended to update the firmware of the WAGO PFC200 device to a version that is not vulnerable to CVE-2021-21001.

Vulnerability/
CVE-2021-21001

critical

9.1

CWE

20/5/2021

3/8/2024

CVE-2021-21001: WAGO: PFC200 Access to files outside the home directory

First published: Thu May 20 2021(Updated: )

On WAGO PFC200 devices in different firmware versions with special crafted packets an authorised attacker with network access to the device can access the file system with higher privileges.

Credit: info@cert.vde.com

Affected Software	Affected Version	How to fix
Wago 750-823 Firmware	<=fw07
WAGO 750-823
Wago 750-829 Firmware	<=fw14
Wago 750-829
Wago 750-831 Firmware	<=fw14
WAGO 750-831
Wago 750-832 Firmware	<=fw06
WAGO 750-832
Wago 750-852 Firmware	<=fw14
WAGO 750-852
Wago 750-862 Firmware	<=fw07
WAGO 750-862
Wago 750-880 Firmware	<=fw15
WAGO 750-880
Wago 750-881 Firmware	<=fw14
WAGO 750-881
Wago 750-882 Firmware	<=fw14
WAGO 750-882
Wago 750-885 Firmware	<=fw14
WAGO 750-885
Wago 750-889 Firmware	<=fw14
WAGO 750-889
Wago 750-890 Firmware	<=fw07
WAGO 750-890
Wago 750-891 Firmware	<=fw07
WAGO 750-891
Wago 750-893 Firmware	<=fw07
Wago 750-893
Wago 750-8202 Firmware	<03.06.19_\(18\)
WAGO 750-8202
Wago 750-8203 Firmware	<03.06.19_\(18\)
Wago 750-8203
Wago 750-8204 Firmware	<03.06.19_\(18\)
Wago 750-8204
Wago 750-8206 Firmware	<03.06.19_\(18\)
Wago 750-8206
Wago 750-8207 Firmware	<03.06.19_\(18\)
Wago 750-8207
Wago 750-8208 Firmware	<03.06.19_\(18\)
Wago 750-8208
Wago 750-8210 Firmware	<03.06.19_\(18\)
Wago 750-8210
Wago 750-8211 Firmware	<03.06.19_\(18\)
Wago 750-8211
Wago 750-8212 Firmware	<03.06.19_\(18\)
Wago 750-8212
Wago 750-8213 Firmware	<03.06.19_\(18\)
Wago 750-8213
Wago 750-8214 Firmware	<03.06.19_\(18\)
Wago 750-8214
Wago 750-8216 Firmware	<03.06.19_\(18\)
Wago 750-8216
Wago 750-8217 Firmware	<03.06.19_\(18\)
Wago 750-8217

Remedy

WAGO recommends all effected users with CODESYS 2.3 Runtime PLCs to update to the firmware versions listed at https://cert.vde.com/en-us/advisories/vde-2021-014 in the solution paragraph.

Never miss a vulnerability like this again

Reference Links

https://cert.vde.com/en-us/advisories/vde-2021-014

Frequently Asked Questions

What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-21001.
What is the severity of CVE-2021-21001?
The severity of CVE-2021-21001 is critical with a severity value of 6.5.
Which devices are affected by CVE-2021-21001?
WAGO PFC200 devices in different firmware versions are affected by CVE-2021-21001.
How can an attacker exploit CVE-2021-21001?
An authorized attacker with network access to the WAGO PFC200 device can exploit CVE-2021-21001 by using specially crafted packets to access the file system with higher privileges.
Is there a fix available for CVE-2021-21001?
It is recommended to update the firmware of the WAGO PFC200 device to a version that is not vulnerable to CVE-2021-21001.