Detections
Analytics
Wago 750-36X & 750-8XX Improper Authentication (CVE-2021-34578)
high Tenable OT Security Plugin ID 500686
Synopsis
The remote OT asset is affected by a vulnerability.Description
This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically constructed requests without authentication on multiple WAGO PLCs in firmware versions up to FW07.- This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically constructed requests without authentication on multiple WAGO PLCs in firmware versions up to FW07. (CVE-2021-34578)
This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information.
Solution
Refer to the vendor advisory.See Also
Plugin Details
Severity: High
ID: 500686
Version: 1.5
Type: remote
Family: Tenable.ot
Published: 7/21/2022
Updated: 10/17/2023
Supported Sensors: Tenable OT Security
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2021-34578
CVSS v3
Risk Factor: High
Base Score: 8.1
Temporal Score: 7.1
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:wago:750-362_firmware, cpe:/o:wago:750-363_firmware, cpe:/o:wago:750-823_firmware, cpe:/o:wago:750-832%2f000-002_firmware, cpe:/o:wago:750-832_firmware, cpe:/o:wago:750-862_firmware, cpe:/o:wago:750-890%2f025-000_firmware, cpe:/o:wago:750-890%2f025-001_firmware, cpe:/o:wago:750-890%2f025-002_firmware, cpe:/o:wago:750-890%2f040-000_firmware, cpe:/o:wago:750-891_firmware, cpe:/o:wago:750-893_firmware
Required KB Items: Tenable.ot/Wago
Exploit Ease: No known exploits are available
Patch Publication Date: 8/31/2021
Vulnerability Publication Date: 8/31/2021
Reference Information
CVE: CVE-2021-34578
CWE: 287