Skip to content
OpenAdvisories
Critical VDE-2021-013 6 CVEs

WAGO: Multiple Vulnerabilities in the Web-Based Management Interface

Published May 5, 2021 · Updated May 14, 2025 · Revision 2

Vendor: Phoenix Contact Product: 0852-0303 Product: 0852-1305 Product: 0852-1305/000-001 Product: 0852-1505 Product: 0852-1505/000-001

Summary

The Web-Based Management (WBM) of WAGOs industrial managed switches is typically used for administration, commissioning and updates.

The reported vulnerabilities allow an attacker with access to the device and the Web-Based Management, to install malware, access to password hashes and create user with admin credentials.

Details

Mitigation
- Disable the web server of the device.
- Use the CLI interface of the device.
- Update to the latest firmware.
- Restrict network access to the device.
- Do not directly connect the device to the internet.

Impact
By exploiting the described vulnerabilities, the attacker potentially is able to manipulate or to disrupt the device.

Remediation
The Web-Based Management is only needed during installation and commissioning, not during normal operations. It is recommended to disable the web server after commissioning. The Command Line Interface (CLI) is an alternative for commissioning the device. This is the easiest and securest way to protect your device from the listed vulnerabilities.

Regardless of the action described above, the vulnerabilities are fixed with following firmware releases.
| **Item Number** | **FW Version** |
|------------------------|-----------------|
| 0852-0303 (HW<3)* | V1.2.5.S0 |
| 0852-0303 (HW>=3)* | V1.2.3.S1 |
| 0852-1305 | V1.1.8.S0 |
| 0852-1505 | V1.1.7.S0 |
| 0852-1305/000-001 | V1.1.4.S0 |
| 0852-1505/000-001 | V1.1.4.S0 |

Vulnerabilities 6

  • Critical 10.0
    CVE-2021-20998

    WAGO: Managed Switches: Unauthorized creation of user accounts

    In multiple managed switches by WAGO in different versions without authorization and with specially crafted packets it is possible to create users.

    WAGO 0852-0303 0852-1505 0852-1505/000-001 ICS / OT
  • High 8.8
    CVE-2021-20994

    WAGO: Managed Switches: Reflected Cross-site Scripting

    In multiple managed switches by WAGO in different versions an attacker may trick a legitimate user to click a link to inject possible malicious code into the Web-Based Management.

    WAGO 0852-0303 0852-1505 0852-1505/000-001 ICS / OT
  • High 7.5
    CVE-2021-20997

    WAGO: Managed Switches: Unauthorized access to password hashes

    In multiple managed switches by WAGO in different versions it is possible to read out the password hashes of all Web-based Management users.

    WAGO 0852-0303 0852-1505 0852-1505/000-001 ICS / OT
  • Medium 5.3
    CVE-2021-20993

    WAGO: Managed Switches: Exposure of sensitive information through directory listing

    In multiple managed switches by WAGO in different versions the activated directory listing provides an attacker with the index of the resources located inside the directory.

    WAGO 0852-0303 0852-1505 0852-1505/000-001 ICS / OT
  • Medium 5.3
    CVE-2021-20995

    WAGO: Managed Switches: Storage of user credentials in a cookie

    In multiple managed switches by WAGO in different versions the webserver cookies of the web based UI contain user credentials.

    WAGO 0852-0303 0852-1505 0852-1505/000-001 ICS / OT
  • Medium 5.3
    CVE-2021-20996

    WAGO: Managed Switches: Unsecure Cookie settings

    In multiple managed switches by WAGO in different versions special crafted requests can lead to cookies being transferred to third parties.

    WAGO 0852-1505 0852-1505/000-001 0852-1305 ICS / OT

Revision history

  1. #2

    Fix: version space, added distribution

  2. #1

    Initial revision.

References