Medium severity · published May 13, 2021
CVE-2021-20993
In multiple managed switches by WAGO in different versions the activated directory listing provides an attacker with the index of the resources located inside the directory
5.3
CVSS
0.8%
EPSS
No
On KEV
Description
In multiple managed switches by WAGO in different versions the activated directory listing provides an attacker with the index of the resources located inside the directory.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
0F
0852-0303 Firmware · Wago
through 1.2.3.s0 · source: NVD
0F
0852-1305 Firmware · Wago
through 1.1.7.s0 · source: NVD
0F
0852-1305/000-001 Firmware · Wago
through 1.0.4.s0 · source: NVD
0F
0852-1505 Firmware · Wago
through 1.1.6.s0 · source: NVD
0F
0852-1505/000-001 Firmware · Wago
through 1.0.4.s0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-20993
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-20993
Third Party Advisory
https://cert.vde.com/en-us/advisories/vde-2021-013
More from 0852-0303 Firmware
9.8
CVE-2021-20998
In multiple managed switches by WAGO in different versions without authorization and with specially crafted packets it is possible to create users
7.5
CVE-2021-20997
In multiple managed switches by WAGO in different versions it is possible to read out the password hashes of all Web-based Management users
7.5
CVE-2021-20995
In multiple managed switches by WAGO in different versions the webserver cookies of the web based UI contain user credentials
6.1
CVE-2021-20994
In multiple managed switches by WAGO in different versions an attacker may trick a legitimate user to click a link to inject possible malicious code into the Web-Based Management
5.3
CVE-2021-20996
In multiple managed switches by WAGO in different versions special crafted requests can lead to cookies being transferred to third parties