Skip to content
CVE PROGRAM SOURCE RECORD9.1 Critical

CVE-2021-21001

WAGO: PFC200 Access to files outside the home directory

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CERTVDE

Description

On WAGO PFC200 devices in different firmware versions with special crafted packets an authorised attacker with network access to the device can access the file system with higher privileges.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WAGO Series PFC200 Controller

  • 750-823 to ≤ FW07affected
  • 750-829 to ≤ FW14affected
  • 750-831/000-00x to ≤ FW14affected
  • 750-832/000-00x to ≤ FW06affected
  • 750-852 to ≤ FW14affected
  • 750-862 to ≤ FW07affected
  • 750-880/0xx-xxx to ≤ FW15affected
  • 750-881 to ≤ FW14affected
  • 750-882 to ≤ FW14affected
  • 750-885/0xx-xxx to ≤ FW14affected
  • 750-889 to ≤ FW14affected
  • 750-890/0xx-xxx to ≤ FW07affected
  • 750-891 to ≤ FW07affected
  • 750-893 to ≤ FW07affected

WAGO Series Ethernet Controller

  • 750-8202/xxx-xxx to < 03.06.19 (18)affected
  • 750-8203/xxx-xxx to < 03.06.19 (18)affected
  • 750-8204/xxx-xxx to < 03.06.19 (18)affected
  • 750-8206/xxx-xxx to < 03.06.19 (18)affected
  • 750-8207/xxx-xxx to < 03.06.19 (18)affected
  • 750-8208/xxx-xxx to < 03.06.19 (18)affected
  • 750-8210/xxx-xxx to < 03.06.19 (18)affected
  • 750-8211/xxx-xxx to < 03.06.19 (18)affected
  • 750-8212/xxx-xxx to < 03.06.19 (18)affected
  • 750-8213/xxx-xxx to < 03.06.19 (18)affected
  • 750-8214/xxx-xxx to < 03.06.19 (18)affected
  • 750-8216/xxx-xxx to < 03.06.19 (18)affected
  • 750-8217/xxx-xxx to < 03.06.19 (18)affected

References