CVE-2021-21001 WAGO: PFC200 Access to files outside the home directory
An authorized attacker can access files outside the home directory with higher privileges on WAGO PFC200 controllers via crafted packets.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-21001?
CVE-2021-21001 is a critical path traversal vulnerability in WAGO Series Ethernet Controller, published on 24 May 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
On WAGO PFC200 devices in different firmware versions with special crafted packets an authorised attacker with network access to the device can access the file system with higher privileges.
Weakness: CWE-22
Which versions are affected by CVE-2021-21001?
It affects 27 products.
Products include Wago 750-8202 Firmware, Wago 750-8203 Firmware, Wago 750-8204 Firmware, Wago 750-8206 Firmware, Wago 750-8207 Firmware, Wago 750-8208 Firmware and 21 more.
How do I fix CVE-2021-21001?
No fix has been published for CVE-2021-21001 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-21001 being exploited?
There is no known exploitation of CVE-2021-21001 in the wild and no public exploit code.
Other vulnerabilities in WAGO Series Ethernet Controller
Sources
Also known as GHSA-52pm-rch7-vfc5.