852-1305
by Wago
CVEs (8)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-20998 | Cri | 0.65 | 10.0 | 0.01 | May 13, 2021 | In multiple managed switches by WAGO in different versions without authorization and with specially crafted packets it is possible to create users. | ||
| CVE-2019-12550 | Cri | 0.64 | 9.8 | 0.03 | Jun 17, 2019 | WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded users and passwords that can be used to login via SSH and TELNET. | ||
| CVE-2019-12549 | Cri | 0.64 | 9.8 | 0.03 | Jun 17, 2019 | WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded private keys for the SSH daemon. The fingerprint of the SSH host key from the corresponding SSH daemon matches the embedded private key. | ||
| CVE-2021-20994 | Hig | 0.57 | 8.8 | 0.01 | May 13, 2021 | In multiple managed switches by WAGO in different versions an attacker may trick a legitimate user to click a link to inject possible malicious code into the Web-Based Management. | ||
| CVE-2021-20997 | Hig | 0.49 | 7.5 | 0.01 | May 13, 2021 | In multiple managed switches by WAGO in different versions it is possible to read out the password hashes of all Web-based Management users. | ||
| CVE-2021-20996 | Med | 0.35 | 5.3 | 0.01 | May 13, 2021 | In multiple managed switches by WAGO in different versions special crafted requests can lead to cookies being transferred to third parties. | ||
| CVE-2021-20993 | Med | 0.35 | 5.3 | 0.01 | May 13, 2021 | In multiple managed switches by WAGO in different versions the activated directory listing provides an attacker with the index of the resources located inside the directory. | ||
| CVE-2021-20995 | Med | 0.34 | 5.3 | 0.01 | May 13, 2021 | In multiple managed switches by WAGO in different versions the webserver cookies of the web based UI contain user credentials. |
- risk 0.65cvss 10.0epss 0.01
In multiple managed switches by WAGO in different versions without authorization and with specially crafted packets it is possible to create users.
- risk 0.64cvss 9.8epss 0.03
WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded users and passwords that can be used to login via SSH and TELNET.
- risk 0.64cvss 9.8epss 0.03
WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded private keys for the SSH daemon. The fingerprint of the SSH host key from the corresponding SSH daemon matches the embedded private key.
- risk 0.57cvss 8.8epss 0.01
In multiple managed switches by WAGO in different versions an attacker may trick a legitimate user to click a link to inject possible malicious code into the Web-Based Management.
- risk 0.49cvss 7.5epss 0.01
In multiple managed switches by WAGO in different versions it is possible to read out the password hashes of all Web-based Management users.
- risk 0.35cvss 5.3epss 0.01
In multiple managed switches by WAGO in different versions special crafted requests can lead to cookies being transferred to third parties.
- risk 0.35cvss 5.3epss 0.01
In multiple managed switches by WAGO in different versions the activated directory listing provides an attacker with the index of the resources located inside the directory.
- risk 0.34cvss 5.3epss 0.01
In multiple managed switches by WAGO in different versions the webserver cookies of the web based UI contain user credentials.