CVSS: 8.8EPSS: 0%CPEs: 10EXPL: 0CVE-2021-20994 – WAGO: Managed Switches: Reflected Cross-site Scripting
https://notcve.org/view.php?id=CVE-2021-20994
In multiple managed switches by WAGO in different versions an attacker may trick a legitimate user to click a link to inject possible malicious code into the Web-Based Management. En múltiples switches administrados por WAGO en diferentes versiones, un atacante puede engañar a un usuario legítimo para que haga clic en un enlace para inyectar un posible código malicioso en la Administración Basada en Web • https://cert.vde.com/en-us/advisories/vde-2021-013 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 10EXPL: 0CVE-2021-20993 – WAGO: Managed Switches: Exposure of sensitive information through directory listing
https://notcve.org/view.php?id=CVE-2021-20993
In multiple managed switches by WAGO in different versions the activated directory listing provides an attacker with the index of the resources located inside the directory. En múltiples switches administrados por WAGO en diferentes versiones, la lista de directorios activados proporciona al atacante el índice de los recursos ubicados dentro del directorio • https://cert.vde.com/en-us/advisories/vde-2021-013 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 0%CPEs: 23EXPL: 0CVE-2020-12525 – WAGO/M&M Software Deserialization of untrusted data in fdtCONTAINER component
https://notcve.org/view.php?id=CVE-2020-12525
M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its project storage. El componente fdtCONTAINER de M&M Software en versiones por debajo de 3.5.20304.x y entre 3.6 y 3.6.20304.x, es vulnerable a una deserialización de datos que no son de confianza en el almacenamiento de su proyecto • https://cert.vde.com/en-us/advisories/vde-2020-038 https://us-cert.cisa.gov/ics/advisories/icsa-21-021-05 • CWE-502: Deserialization of Untrusted Data •
CVSS: 10.0EPSS: 0%CPEs: 42EXPL: 0CVE-2020-12522 – Command Injection Vulnerability in I/O-Check Service of WAGO PFC100, PFC200 and Touch Panel 600 Series with firmware versions <=FW10
https://notcve.org/view.php?id=CVE-2020-12522
The reported vulnerability allows an attacker who has network access to the device to execute code with specially crafted packets in WAGO Series PFC 100 (750-81xx/xxx-xxx), Series PFC 200 (750-82xx/xxx-xxx), Series Wago Touch Panel 600 Standard Line (762-4xxx), Series Wago Touch Panel 600 Advanced Line (762-5xxx), Series Wago Touch Panel 600 Marine Line (762-6xxx) with firmware versions <=FW10. La vulnerabilidad reportada permite a un atacante que tiene acceso de red al dispositivo ejecutar código con paquetes especialmente diseñados en WAGO Serie PFC 100 (750-81xx/xxx-xxx), Series PFC 200 (750-82xx/xxx-xxx), Series Wago Touch Panel 600 Standard Line (762-4xxx), Series Wago Touch Panel 600 Advanced Line (762-5xxx), Series Wago Touch Panel 600 Marine Line (762-6xxx) con versiones de firmware anteriores a FW10 incluyéndola • https://cert.vde.com/en-us/advisories/vde-2020-045 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 20EXPL: 0CVE-2020-12516 – WAGO: PLC families 750-88x and 750-352 prone to DoS attack
https://notcve.org/view.php?id=CVE-2020-12516
Older firmware versions (FW1 up to FW10) of the WAGO PLC family 750-88x and 750-352 are vulnerable for a special denial of service attack. Las versiones de firmware más antiguas (FW1 hasta FW10) de la familia de PLC WAGO 750-88x y 750-352, son vulnerables a un ataque de denegación de servicio especial. • https://cert.vde.com/en-us/advisories/vde-2020-042 https://us-cert.cisa.gov/ics/advisories/icsa-20-308-01 • CWE-400: Uncontrolled Resource Consumption •