CVE-2021-34578

high-risk

Published 2021-08-31

This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically constructed requests without authentication on multiple WAGO PLCs in firmware versions up to FW07.

Do I need to act?

0.34% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (12)

750-890\/040-000 Firmware

750-890\/025-001 Firmware

750-890\/025-002 Firmware

750-890\/025-000 Firmware

750-832\/000-002 Firmware

750-362 Firmware

750-823 Firmware

750-832 Firmware

750-363 Firmware

750-862 Firmware

750-891 Firmware

750-893 Firmware

Affected Vendors

Wago

References (2)

Third Party Advisory https://cert.vde.com/en-us/advisories/vde-2020-044

/ 100

high-risk

Severity 32/34 · Critical

Exploitability 1/34 · Minimal

Exposure 17/34 · Moderate