{ "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] }, { "organization": "imec-DistriNet", "summary": "reporting.", "names": [ "Mathy Vanhoef" ] }, { "names": [ "KU Leuven" ], "organization": "krackattacks", "summary": "reporting." } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-US", "notes": [ { "category": "summary", "text": "Multiple vulnerabilities were reported in CODESYS 2.3 Runtime. The CODESYS 2.3 Runtime is an essential component in several WAGO PLC's.", "title": "Summary" }, { "category": "description", "text": "The reported vulnerabilities allow an attacker who has access to the device and is able to exploit the vulnerabilities, to manipulate and disrupt the CODESYS 2.3 Runtime.", "title": "Impact" }, { "category": "description", "title": "Remediation", "text": "WAGO recommends all effected users with CODESYS 2.3 Runtime PLCs to update to the firmware version listed below.\n\nSeries Ethernet Controller:\n **Article No.** | **Fixed Version** | **Available** |\n|-----------------------|-------------------|----------------|\n| 750-823 | >=FW08 | June 2021 |\n| 750-829 | >=FW15 | May 2021 |\n| 750-831/000-00x | >=FW15 | May 2021 |\n| 750-832/000-00x | >=FW08 | June 2021 |\n| 750-852 | >=FW15 | May 2021 |\n| 750-862 | >=FW08 | June 2021 |\n| 750-880/0xx-xxx | >=FW16 | May 2021 |\n| 750-881 | >=FW15 | May 2021 |\n| 750-882 | >=FW15 | May 2021 |\n| 750-885/0xx-xxx | >=FW15 | May 2021 |\n| 750-889 | >=FW15 | May 2021 |\n| 750-890/0xx-xxx | >=FW08 | June 2021 |\n| 750-891 | >=FW08 | June 2021 |\n| 750-893 | >=FW08 | June 2021 |\n\nSeries PFC200 Controller\n| **Article No.** | **Fixed Patch** | **Patch Available** | **Fixed Firmware** | **Firmware Approx. Available** |\n|------------------------|-----------------------|----------------------|--------------------|---------------------------------|\n| 750-8202/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |\n| 750-8203/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |\n| 750-8204/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |\n| 750-8206/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |\n| 750-8207/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |\n| 750-8208/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |\n| 750-8210/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |\n| 750-8211/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |\n| 750-8212/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |\n| 750-8213/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |\n| 750-8214/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |\n| 750-8216/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |\n| 750-8217/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |\n" }, { "category": "description", "title": "Mitigation", "text": "1. Use general security best practices to protect systems from local and network attacks.\n2. Do not allow direct access to the device from untrusted networks.\n3. Update to the latest firmware according to the table in chapter solutions.\n4. Disable the CODESYS 2.3 Web-Visualisation and CODESYS 2.3 port 2455.\n\nFor further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html external link" } ], "publisher": { "category": "vendor", "contact_details": "psirt@wago.com", "name": "WAGO GmbH & Co. KG", "namespace": "https://www.wago.com/psirt" }, "references": [ { "category": "external", "summary": "WAGO advisory overview at CERT@VDE", "url": "https://certvde.com/de/advisories/vendor/wago/" }, { "category": "self", "summary": "VDE-2021-014: WAGO: Multiple Vulnerabilities in CODESYS Runtime 2.3 - HTML", "url": "https://certvde.com/en/advisories/VDE-2021-014" }, { "summary": "VDE-2021-014: WAGO: Multiple Vulnerabilities in CODESYS Runtime 2.3 - CSAF", "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2021/vde-2021-014.json", "category": "self" } ], "title": "WAGO: Multiple Vulnerabilities in CODESYS Runtime 2.3", "tracking": { "aliases": [ "VDE-2021-014" ], "current_release_date": "2025-05-22T13:03:10.000Z", "generator": { "date": "2025-01-15T12:21:13.476Z", "engine": { "name": "Secvisogram", "version": "2.5.16" } }, "id": "VDE-2021-014", "initial_release_date": "2021-05-20T09:08:00.000Z", "revision_history": [ { "date": "2021-05-15T09:00:00.000Z", "number": "1", "summary": "Initial revision." }, { "number": "2", "summary": "Fix: version space, added distribution, quotation mark", "date": "2025-05-22T13:03:10.000Z" } ], "status": "final", "version": "2" } }, "product_tree": { "product_groups": [ { "group_id": "CSAFGID-0001", "summary": "Affected Products.", "product_ids": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021", "CSAFPID-31022", "CSAFPID-31023", "CSAFPID-31024", "CSAFPID-31025", "CSAFPID-31026" ] }, { "group_id": "CSAFGID-0002", "summary": "Fixed Products.", "product_ids": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014", "CSAFPID-32015", "CSAFPID-32016", "CSAFPID-32017", "CSAFPID-32018", "CSAFPID-32019", "CSAFPID-32020", "CSAFPID-32021", "CSAFPID-32022", "CSAFPID-32023", "CSAFPID-32024", "CSAFPID-32025", "CSAFPID-32026", "CSAFPID-32027", "CSAFPID-32028", "CSAFPID-32029", "CSAFPID-32030", "CSAFPID-32031", "CSAFPID-32032", "CSAFPID-32033", "CSAFPID-32034", "CSAFPID-32035", "CSAFPID-32036", "CSAFPID-32037", "CSAFPID-32038", "CSAFPID-32039", "CSAFPID-32040" ] } ], "branches": [ { "category": "vendor", "name": "WAGO", "branches": [ { "name": "Hardware", "category": "product_family", "branches": [ { "name": "750-8202/xxx-xxx", "category": "product_name", "product": { "name": "750-8202/xxx-xxx", "product_id": "CSAFPID-11001" } }, { "name": "750-8203/xxx-xxx", "category": "product_name", "product": { "name": "750-8203/xxx-xxx", "product_id": "CSAFPID-11002" } }, { "name": "750-8204/xxx-xxx", "category": "product_name", "product": { "name": "750-8204/xxx-xxx", "product_id": "CSAFPID-11003" } }, { "name": "750-8206/xxx-xxx", "category": "product_name", "product": { "name": "750-8206/xxx-xxx", "product_id": "CSAFPID-11004" } }, { "name": "750-8207/xxx-xxx", "category": "product_name", "product": { "name": "750-8207/xxx-xxx", "product_id": "CSAFPID-11005" } }, { "name": "750-8208/xxx-xxx", "category": "product_name", "product": { "name": "750-8208/xxx-xxx", "product_id": "CSAFPID-11006" } }, { "name": "750-8210/xxx-xxx", "category": "product_name", "product": { "name": "750-8210/xxx-xxx", "product_id": "CSAFPID-11007" } }, { "name": "750-8211/xxx-xxx", "category": "product_name", "product": { "name": "750-8211/xxx-xxx", "product_id": "CSAFPID-11008" } }, { "name": "750-8212/xxx-xxx", "category": "product_name", "product": { "name": "750-8212/xxx-xxx", "product_id": "CSAFPID-11009" } }, { "name": "750-8213/xxx-xxx", "category": "product_name", "product": { "name": "750-8213/xxx-xxx", "product_id": "CSAFPID-11010" } }, { "name": "750-8214/xxx-xxx", "category": "product_name", "product": { "name": "750-8214/xxx-xxx", "product_id": "CSAFPID-11011" } }, { "name": "750-8216/xxx-xxx", "category": "product_name", "product": { "name": "750-8216/xxx-xxx", "product_id": "CSAFPID-11012" } }, { "name": "750-8217/xxx-xxx", "category": "product_name", "product": { "name": "750-8217/xxx-xxx", "product_id": "CSAFPID-11013" } }, { "name": "750-823", "category": "product_name", "product": { "name": "750-823", "product_id": "CSAFPID-11014" } }, { "name": "750-829", "category": "product_name", "product": { "name": "750-829", "product_id": "CSAFPID-11015" } }, { "name": "750-831/000-00x", "category": "product_name", "product": { "name": "750-831/000-00x", "product_id": "CSAFPID-11016" } }, { "name": "750-832/000-00x", "category": "product_name", "product": { "name": "750-832/000-00x", "product_id": "CSAFPID-11017" } }, { "name": "750-852", "category": "product_name", "product": { "name": "750-852", "product_id": "CSAFPID-11018" } }, { "name": "750-862", "category": "product_name", "product": { "name": "750-862", "product_id": "CSAFPID-11019" } }, { "name": "750-880/0xx-xxx", "category": "product_name", "product": { "name": "750-880/0xx-xxx", "product_id": "CSAFPID-11020" } }, { "name": "750-881", "category": "product_name", "product": { "name": "750-881", "product_id": "CSAFPID-11021" } }, { "name": "750-882", "category": "product_name", "product": { "name": "750-882", "product_id": "CSAFPID-11022" } }, { "name": "750-885/0xx-xxx", "category": "product_name", "product": { "name": "750-885/0xx-xxx", "product_id": "CSAFPID-11023" } }, { "name": "750-889", "category": "product_name", "product": { "name": "750-889", "product_id": "CSAFPID-11024" } }, { "name": "750-890/0xx-xxx", "category": "product_name", "product": { "name": "750-890/0xx-xxx", "product_id": "CSAFPID-11025" } }, { "name": "750-891", "category": "product_name", "product": { "name": "750-891", "product_id": "CSAFPID-11026" } }, { "name": "750-893", "category": "product_name", "product": { "name": "750-893", "product_id": "CSAFPID-11027" } } ] }, { "name": "Firmware", "category": "product_family", "branches": [ { "name": "<03.06.19 (18)", "category": "product_version_range", "product": { "name": "Firmware <03.06.19 (18)", "product_id": "CSAFPID-21001" } }, { "name": "<=FW06", "category": "product_version_range", "product": { "name": "Firmware <=FW06", "product_id": "CSAFPID-21002" } }, { "name": "<=FW07", "category": "product_version_range", "product": { "name": "Firmware <=FW07", "product_id": "CSAFPID-21003" } }, { "name": "<=FW14", "category": "product_version_range", "product": { "name": "Firmware <=FW14", "product_id": "CSAFPID-21004" } }, { "name": "<=FW15", "category": "product_version_range", "product": { "name": "Firmware <=FW15", "product_id": "CSAFPID-21005" } }, { "name": "FW08", "category": "product_version", "product": { "name": "Firmware FW08", "product_id": "CSAFPID-22001" } }, { "name": "FW15", "category": "product_version", "product": { "name": "Firmware FW15", "product_id": "CSAFPID-22002" } }, { "name": "FW16", "category": "product_version", "product": { "name": "Firmware FW16", "product_id": "CSAFPID-22004" } }, { "name": "03.06.19 (18)", "category": "patch_level", "product": { "name": "Firmware 03.06.19 (18)", "product_id": "CSAFPID-22005" } }, { "name": "FW19", "category": "product_version", "product": { "name": "Firmware FW19", "product_id": "CSAFPID-22006" } } ] } ] } ], "relationships": [ { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11001", "full_product_name": { "name": "Firmware <03.06.19 (18) installed on 750-8202/xxx-xxx", "product_id": "CSAFPID-31001" } }, { "product_reference": "CSAFPID-21001", "category": "installed_on", "relates_to_product_reference": "CSAFPID-11002", "full_product_name": { "name": "Firmware <03.06.19 (18) installed on 750-8203/xxx-xxx", "product_id": "CSAFPID-31002" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11003", "category": "installed_on", "full_product_name": { "name": "Firmware <03.06.19 (18) installed on 750-8204/xxx-xxx", "product_id": "CSAFPID-31003" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11004", "category": "installed_on", "full_product_name": { "name": "Firmware <03.06.19 (18) installed on 750-8206/xxx-xxx", "product_id": "CSAFPID-31004" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11005", "category": "installed_on", "full_product_name": { "name": "Firmware <03.06.19 (18) installed on 750-8207/xxx-xxx", "product_id": "CSAFPID-31005" } }, { "product_reference": "CSAFPID-21001", "category": "installed_on", "relates_to_product_reference": "CSAFPID-11006", "full_product_name": { "name": "Firmware <03.06.19 (18) installed on 750-8208/xxx-xxx", "product_id": "CSAFPID-31006" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11007", "category": "installed_on", "full_product_name": { "name": "Firmware <03.06.19 (18) installed on 750-8210/xxx-xxx", "product_id": "CSAFPID-31007" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11008", "category": "installed_on", "full_product_name": { "name": "Firmware <03.06.19 (18) installed on 750-8211/xxx-xxx", "product_id": "CSAFPID-31008" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11009", "category": "installed_on", "full_product_name": { "name": "Firmware <03.06.19 (18) installed on 750-8212/xxx-xxx", "product_id": "CSAFPID-31009" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11010", "category": "installed_on", "full_product_name": { "name": "Firmware <03.06.19 (18) installed on 750-8213/xxx-xxx", "product_id": "CSAFPID-31010" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11011", "category": "installed_on", "full_product_name": { "name": "Firmware <03.06.19 (18) installed on 750-8214/xxx-xxx", "product_id": "CSAFPID-31011" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11012", "category": "installed_on", "full_product_name": { "name": "Firmware <03.06.19 (18) installed on 750-8216/xxx-xxx", "product_id": "CSAFPID-31012" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11013", "category": "installed_on", "full_product_name": { "name": "Firmware <03.06.19 (18) installed on 750-8217/xxx-xxx", "product_id": "CSAFPID-31013" } }, { "product_reference": "CSAFPID-21003", "relates_to_product_reference": "CSAFPID-11014", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW07 installed on 750-823", "product_id": "CSAFPID-31014" } }, { "product_reference": "CSAFPID-21004", "relates_to_product_reference": "CSAFPID-11015", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW14 installed on 750-829", "product_id": "CSAFPID-31015" } }, { "product_reference": "CSAFPID-21004", "relates_to_product_reference": "CSAFPID-11016", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW14 installed on 750-831/000-00x", "product_id": "CSAFPID-31016" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11017", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW06 installed on 750-832/000-00x", "product_id": "CSAFPID-31017" } }, { "product_reference": "CSAFPID-21004", "relates_to_product_reference": "CSAFPID-11018", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW14 installed on 750-852", "product_id": "CSAFPID-31018" } }, { "product_reference": "CSAFPID-21003", "relates_to_product_reference": "CSAFPID-11019", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW07 installed on 750-862", "product_id": "CSAFPID-31019" } }, { "product_reference": "CSAFPID-21005", "relates_to_product_reference": "CSAFPID-11020", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW15 installed on 750-880/0xx-xxx", "product_id": "CSAFPID-31020" } }, { "product_reference": "CSAFPID-21004", "relates_to_product_reference": "CSAFPID-11021", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW14 installed on 750-881", "product_id": "CSAFPID-31021" } }, { "product_reference": "CSAFPID-21004", "relates_to_product_reference": "CSAFPID-11022", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW14 installed on 750-882", "product_id": "CSAFPID-31022" } }, { "product_reference": "CSAFPID-21004", "relates_to_product_reference": "CSAFPID-11023", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW14 installed on 750-885/0xx-xxx", "product_id": "CSAFPID-31023" } }, { "product_reference": "CSAFPID-21004", "relates_to_product_reference": "CSAFPID-11024", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW14 installed on 750-889", "product_id": "CSAFPID-31024" } }, { "product_reference": "CSAFPID-21003", "relates_to_product_reference": "CSAFPID-11025", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW07 installed on 750-890/0xx-xxx", "product_id": "CSAFPID-31025" } }, { "product_reference": "CSAFPID-21003", "relates_to_product_reference": "CSAFPID-11026", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW07 installed on 750-891", "product_id": "CSAFPID-31026" } }, { "product_reference": "CSAFPID-21003", "relates_to_product_reference": "CSAFPID-11027", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW07 installed on 750-893", "product_id": "CSAFPID-31027" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11014", "category": "installed_on", "full_product_name": { "name": "Firmware FW08 installed on 750-823", "product_id": "CSAFPID-32001" } }, { "product_reference": "CSAFPID-32010", "relates_to_product_reference": "CSAFPID-11015", "category": "installed_on", "full_product_name": { "name": "Firmware FW15 installed on 750-885/0xx-xxx installed on 750-829", "product_id": "CSAFPID-32002" } }, { "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11016", "category": "installed_on", "full_product_name": { "name": "Firmware FW15 installed on 750-831/000-00x", "product_id": "CSAFPID-32003" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11017", "category": "installed_on", "full_product_name": { "name": "Firmware FW08 installed on 750-832/000-00x", "product_id": "CSAFPID-32004" } }, { "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11018", "category": "installed_on", "full_product_name": { "name": "Firmware FW15 installed on 750-852", "product_id": "CSAFPID-32005" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11019", "category": "installed_on", "full_product_name": { "name": "Firmware FW08 installed on 750-862", "product_id": "CSAFPID-32006" } }, { "product_reference": "CSAFPID-22004", "relates_to_product_reference": "CSAFPID-11020", "category": "installed_on", "full_product_name": { "name": "Firmware FW16 installed on 750-880/0xx-xxx", "product_id": "CSAFPID-32007" } }, { "product_reference": "CSAFPID-22002", "category": "installed_on", "relates_to_product_reference": "CSAFPID-11021", "full_product_name": { "name": "Firmware FW15 installed on 750-881", "product_id": "CSAFPID-32008" } }, { "product_reference": "CSAFPID-22002", "category": "installed_on", "relates_to_product_reference": "CSAFPID-11022", "full_product_name": { "name": "Firmware FW15 installed on 750-882", "product_id": "CSAFPID-32009" } }, { "product_reference": "CSAFPID-22002", "category": "installed_on", "relates_to_product_reference": "CSAFPID-11023", "full_product_name": { "name": "Firmware FW15 installed on 750-885/0xx-xxx", "product_id": "CSAFPID-32010" } }, { "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11024", "category": "installed_on", "full_product_name": { "name": "Firmware FW15 installed on 750-889", "product_id": "CSAFPID-32011" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11025", "category": "installed_on", "full_product_name": { "name": "Firmware FW08 installed on 750-890/0xx-xxx", "product_id": "CSAFPID-32012" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11026", "category": "installed_on", "full_product_name": { "name": "Firmware FW08 installed on 750-891", "product_id": "CSAFPID-32013" } }, { "product_reference": "CSAFPID-22001", "category": "installed_on", "relates_to_product_reference": "CSAFPID-11027", "full_product_name": { "name": "Firmware FW08 installed on 750-893", "product_id": "CSAFPID-32014" } }, { "product_reference": "CSAFPID-22005", "category": "installed_on", "relates_to_product_reference": "CSAFPID-11001", "full_product_name": { "name": "Firmware 03.06.19 (18) installed on 750-8202/xxx-xxx", "product_id": "CSAFPID-32015" } }, { "product_reference": "CSAFPID-22005", "category": "installed_on", "relates_to_product_reference": "CSAFPID-11002", "full_product_name": { "name": "Firmware 03.06.19 (18) installed on 750-8203/xxx-xxx", "product_id": "CSAFPID-32016" } }, { "product_reference": "CSAFPID-22005", "relates_to_product_reference": "CSAFPID-11003", "category": "installed_on", "full_product_name": { "name": "Firmware 03.06.19 (18) installed on 750-8204/xxx-xxx", "product_id": "CSAFPID-32017" } }, { "product_reference": "CSAFPID-22005", "relates_to_product_reference": "CSAFPID-11004", "category": "installed_on", "full_product_name": { "name": "Firmware 03.06.19 (18) installed on 750-8206/xxx-xxx", "product_id": "CSAFPID-32018" } }, { "product_reference": "CSAFPID-22005", "relates_to_product_reference": "CSAFPID-11005", "category": "installed_on", "full_product_name": { "name": "Firmware 03.06.19 (18) installed on 750-8207/xxx-xxx", "product_id": "CSAFPID-32019" } }, { "product_reference": "CSAFPID-22005", "relates_to_product_reference": "CSAFPID-11006", "category": "installed_on", "full_product_name": { "name": "Firmware 03.06.19 (18) installed on 750-8208/xxx-xxx", "product_id": "CSAFPID-32020" } }, { "product_reference": "CSAFPID-22005", "relates_to_product_reference": "CSAFPID-11007", "category": "installed_on", "full_product_name": { "name": "Firmware 03.06.19 (18) installed on 750-8210/xxx-xxx", "product_id": "CSAFPID-32021" } }, { "product_reference": "CSAFPID-22005", "relates_to_product_reference": "CSAFPID-11008", "category": "installed_on", "full_product_name": { "name": "Firmware 03.06.19 (18) installed on 750-8211/xxx-xxx", "product_id": "CSAFPID-32022" } }, { "product_reference": "CSAFPID-22005", "relates_to_product_reference": "CSAFPID-11009", "category": "installed_on", "full_product_name": { "name": "Firmware 03.06.19 (18) installed on 750-8212/xxx-xxx", "product_id": "CSAFPID-32023" } }, { "product_reference": "CSAFPID-22005", "relates_to_product_reference": "CSAFPID-11010", "category": "installed_on", "full_product_name": { "name": "Firmware 03.06.19 (18) installed on 750-8213/xxx-xxx", "product_id": "CSAFPID-32024" } }, { "product_reference": "CSAFPID-22005", "relates_to_product_reference": "CSAFPID-11011", "category": "installed_on", "full_product_name": { "name": "Firmware 03.06.19 (18) installed on 750-8214/xxx-xxx", "product_id": "CSAFPID-32025" } }, { "product_reference": "CSAFPID-22005", "relates_to_product_reference": "CSAFPID-11012", "category": "installed_on", "full_product_name": { "name": "Firmware 03.06.19 (18) installed on 750-8216/xxx-xxx", "product_id": "CSAFPID-32026" } }, { "product_reference": "CSAFPID-22005", "relates_to_product_reference": "CSAFPID-11013", "category": "installed_on", "full_product_name": { "name": "Firmware 03.06.19 (18) installed on 750-8217/xxx-xxx", "product_id": "CSAFPID-32027" } }, { "product_reference": "CSAFPID-22006", "category": "installed_on", "relates_to_product_reference": "CSAFPID-11001", "full_product_name": { "name": "Firmware FW19 installed on 750-8202/xxx-xxx", "product_id": "CSAFPID-32028" } }, { "product_reference": "CSAFPID-22006", "category": "installed_on", "relates_to_product_reference": "CSAFPID-11002", "full_product_name": { "name": "Firmware FW19 installed on 750-8203/xxx-xxx", "product_id": "CSAFPID-32029" } }, { "product_reference": "CSAFPID-22006", "relates_to_product_reference": "CSAFPID-11003", "category": "installed_on", "full_product_name": { "name": "Firmware FW19 installed on 750-8204/xxx-xxx", "product_id": "CSAFPID-32030" } }, { "product_reference": "CSAFPID-22006", "relates_to_product_reference": "CSAFPID-11004", "category": "installed_on", "full_product_name": { "name": "Firmware FW19 installed on 750-8206/xxx-xxx", "product_id": "CSAFPID-32031" } }, { "product_reference": "CSAFPID-22006", "relates_to_product_reference": "CSAFPID-11005", "category": "installed_on", "full_product_name": { "name": "Firmware FW19 installed on 750-8207/xxx-xxx", "product_id": "CSAFPID-32032" } }, { "product_reference": "CSAFPID-22006", "relates_to_product_reference": "CSAFPID-11006", "category": "installed_on", "full_product_name": { "name": "Firmware FW19 installed on 750-8208/xxx-xxx", "product_id": "CSAFPID-32033" } }, { "product_reference": "CSAFPID-22006", "relates_to_product_reference": "CSAFPID-11007", "category": "installed_on", "full_product_name": { "name": "Firmware FW19 installed on 750-8210/xxx-xxx", "product_id": "CSAFPID-32034" } }, { "product_reference": "CSAFPID-22006", "relates_to_product_reference": "CSAFPID-11008", "category": "installed_on", "full_product_name": { "name": "Firmware FW19 installed on 750-8211/xxx-xxx", "product_id": "CSAFPID-32035" } }, { "product_reference": "CSAFPID-22006", "relates_to_product_reference": "CSAFPID-11009", "category": "installed_on", "full_product_name": { "name": "Firmware FW19 installed on 750-8212/xxx-xxx", "product_id": "CSAFPID-32036" } }, { "product_reference": "CSAFPID-22006", "relates_to_product_reference": "CSAFPID-11010", "category": "installed_on", "full_product_name": { "name": "Firmware FW19 installed on 750-8213/xxx-xxx", "product_id": "CSAFPID-32037" } }, { "product_reference": "CSAFPID-22006", "relates_to_product_reference": "CSAFPID-11011", "category": "installed_on", "full_product_name": { "name": "Firmware FW19 installed on 750-8214/xxx-xxx", "product_id": "CSAFPID-32038" } }, { "product_reference": "CSAFPID-22006", "relates_to_product_reference": "CSAFPID-11012", "category": "installed_on", "full_product_name": { "name": "Firmware FW19 installed on 750-8216/xxx-xxx", "product_id": "CSAFPID-32039" } }, { "product_reference": "CSAFPID-22006", "relates_to_product_reference": "CSAFPID-11013", "category": "installed_on", "full_product_name": { "name": "Firmware FW19 installed on 750-8217/xxx-xxx", "product_id": "CSAFPID-32040" } } ] }, "vulnerabilities": [ { "cve": "CVE-2021-30192", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "notes": [ { "audience": "all", "category": "description", "text": "Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the four-way handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021", "CSAFPID-31022", "CSAFPID-31023", "CSAFPID-31024", "CSAFPID-31025", "CSAFPID-31026", "CSAFPID-31027" ] }, "remediations": [ { "category": "mitigation", "details": "If an immediate firmware update is not possible, the WLAN on the unit can also be switched off as a precautionary measure.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "Endress+Hauser provides updated firmware versions for all related products from the Proline portfolio which fixes the vulnerability and recommends customers to update to the new fixed version. For support, please contact your local service center.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "environmentalScore": 6.8, "environmentalSeverity": "MEDIUM", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 6.8, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.0" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021", "CSAFPID-31022", "CSAFPID-31023", "CSAFPID-31024", "CSAFPID-31025", "CSAFPID-31026", "CSAFPID-31027" ] } ], "title": "CVE-2021-30192" }, { "cve": "CVE-2021-30193", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "audience": "all", "category": "description", "text": "CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Write.", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021", "CSAFPID-31022", "CSAFPID-31023", "CSAFPID-31024", "CSAFPID-31025", "CSAFPID-31026", "CSAFPID-31027" ] }, "remediations": [ { "category": "mitigation", "details": "If an immediate firmware update is not possible, the WLAN on the unit can also be switched off as a precautionary measure.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "Endress+Hauser provides updated firmware versions for all related products from the Proline portfolio which fixes the vulnerability and recommends customers to update to the new fixed version. For support, please contact your local service center.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021", "CSAFPID-31022", "CSAFPID-31023", "CSAFPID-31024", "CSAFPID-31025", "CSAFPID-31026", "CSAFPID-31027" ] } ], "title": "CVE-2021-30193" }, { "cve": "CVE-2021-30188", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "audience": "all", "category": "description", "text": "CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-based Buffer Overflow.", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021", "CSAFPID-31022", "CSAFPID-31023", "CSAFPID-31024", "CSAFPID-31025", "CSAFPID-31026", "CSAFPID-31027" ] }, "remediations": [ { "category": "mitigation", "details": "If an immediate firmware update is not possible, the WLAN on the unit can also be switched off as a precautionary measure.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "Endress+Hauser provides updated firmware versions for all related products from the Proline portfolio which fixes the vulnerability and recommends customers to update to the new fixed version. For support, please contact your local service center.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021", "CSAFPID-31022", "CSAFPID-31023", "CSAFPID-31024", "CSAFPID-31025", "CSAFPID-31026", "CSAFPID-31027" ] } ], "title": "CVE-2021-30188" }, { "cve": "CVE-2021-30189", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "audience": "all", "category": "description", "text": "CODESYS V2 Web-Server before 1.1.9.20 has a Stack-based Buffer Overflow.", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021", "CSAFPID-31022", "CSAFPID-31023", "CSAFPID-31024", "CSAFPID-31025", "CSAFPID-31026", "CSAFPID-31027" ] }, "remediations": [ { "category": "mitigation", "details": "If an immediate firmware update is not possible, the WLAN on the unit can also be switched off as a precautionary measure.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "Endress+Hauser provides updated firmware versions for all related products from the Proline portfolio which fixes the vulnerability and recommends customers to update to the new fixed version. For support, please contact your local service center.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021", "CSAFPID-31022", "CSAFPID-31023", "CSAFPID-31024", "CSAFPID-31025", "CSAFPID-31026", "CSAFPID-31027" ] } ], "title": "CVE-2021-30189" }, { "cve": "CVE-2021-30190", "cwe": { "id": "CWE-306", "name": "Missing Authentication for Critical Function" }, "notes": [ { "audience": "all", "category": "description", "text": "CODESYS V2 Web-Server before 1.1.9.20 has Improper Access Control.", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021", "CSAFPID-31022", "CSAFPID-31023", "CSAFPID-31024", "CSAFPID-31025", "CSAFPID-31026", "CSAFPID-31027" ] }, "remediations": [ { "category": "mitigation", "details": "If an immediate firmware update is not possible, the WLAN on the unit can also be switched off as a precautionary measure.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "Endress+Hauser provides updated firmware versions for all related products from the Proline portfolio which fixes the vulnerability and recommends customers to update to the new fixed version. For support, please contact your local service center.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021", "CSAFPID-31022", "CSAFPID-31023", "CSAFPID-31024", "CSAFPID-31025", "CSAFPID-31026", "CSAFPID-31027" ] } ], "title": "CVE-2021-30190" }, { "cve": "CVE-2021-30194", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "audience": "all", "category": "description", "text": "CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Read.", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021", "CSAFPID-31022", "CSAFPID-31023", "CSAFPID-31024", "CSAFPID-31025", "CSAFPID-31026", "CSAFPID-31027" ] }, "remediations": [ { "category": "mitigation", "details": "If an immediate firmware update is not possible, the WLAN on the unit can also be switched off as a precautionary measure.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "Endress+Hauser provides updated firmware versions for all related products from the Proline portfolio which fixes the vulnerability and recommends customers to update to the new fixed version. For support, please contact your local service center.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.1, "environmentalSeverity": "CRITICAL", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.1, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021", "CSAFPID-31022", "CSAFPID-31023", "CSAFPID-31024", "CSAFPID-31025", "CSAFPID-31026", "CSAFPID-31027" ] } ], "title": "CVE-2021-30194" }, { "cve": "CVE-2021-30195", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "audience": "all", "category": "description", "text": "CODESYS V2 runtime system before 2.4.7.55 has Improper Input Validation.", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021", "CSAFPID-31022", "CSAFPID-31023", "CSAFPID-31024", "CSAFPID-31025", "CSAFPID-31026", "CSAFPID-31027" ] }, "remediations": [ { "category": "mitigation", "details": "If an immediate firmware update is not possible, the WLAN on the unit can also be switched off as a precautionary measure.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "Endress+Hauser provides updated firmware versions for all related products from the Proline portfolio which fixes the vulnerability and recommends customers to update to the new fixed version. For support, please contact your local service center.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 7.5, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021", "CSAFPID-31022", "CSAFPID-31023", "CSAFPID-31024", "CSAFPID-31025", "CSAFPID-31026", "CSAFPID-31027" ] } ], "title": "CVE-2021-30195" }, { "cve": "CVE-2021-30186", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "audience": "all", "category": "description", "text": "CODESYS V2 runtime system SP before 2.4.7.55 has a Heap-based Buffer Overflow.", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021", "CSAFPID-31022", "CSAFPID-31023", "CSAFPID-31024", "CSAFPID-31025", "CSAFPID-31026", "CSAFPID-31027" ] }, "remediations": [ { "category": "mitigation", "details": "If an immediate firmware update is not possible, the WLAN on the unit can also be switched off as a precautionary measure.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "Endress+Hauser provides updated firmware versions for all related products from the Proline portfolio which fixes the vulnerability and recommends customers to update to the new fixed version. For support, please contact your local service center.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 7.5, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021", "CSAFPID-31022", "CSAFPID-31023", "CSAFPID-31024", "CSAFPID-31025", "CSAFPID-31026", "CSAFPID-31027" ] } ], "title": "CVE-2021-30186" }, { "cve": "CVE-2021-30191", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')" }, "notes": [ { "audience": "all", "category": "description", "text": "CODESYS V2 Web-Server before 1.1.9.20 has a a Buffer Copy without Checking the Size of the Input.", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021", "CSAFPID-31022", "CSAFPID-31023", "CSAFPID-31024", "CSAFPID-31025", "CSAFPID-31026", "CSAFPID-31027" ] }, "remediations": [ { "category": "mitigation", "details": "If an immediate firmware update is not possible, the WLAN on the unit can also be switched off as a precautionary measure.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "Endress+Hauser provides updated firmware versions for all related products from the Proline portfolio which fixes the vulnerability and recommends customers to update to the new fixed version. For support, please contact your local service center.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 7.5, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021", "CSAFPID-31022", "CSAFPID-31023", "CSAFPID-31024", "CSAFPID-31025", "CSAFPID-31026", "CSAFPID-31027" ] } ], "title": "CVE-2021-30191" }, { "cve": "CVE-2021-21000", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "audience": "all", "category": "description", "text": "On WAGO PFC200 devices in different firmware versions with special crafted packets an attacker with network access to the device could cause a denial of service for the login service of the runtime.", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021", "CSAFPID-31022", "CSAFPID-31023", "CSAFPID-31024", "CSAFPID-31025", "CSAFPID-31026", "CSAFPID-31027" ] }, "remediations": [ { "category": "mitigation", "details": "If an immediate firmware update is not possible, the WLAN on the unit can also be switched off as a precautionary measure.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "Endress+Hauser provides updated firmware versions for all related products from the Proline portfolio which fixes the vulnerability and recommends customers to update to the new fixed version. For support, please contact your local service center.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 7.5, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021", "CSAFPID-31022", "CSAFPID-31023", "CSAFPID-31024", "CSAFPID-31025", "CSAFPID-31026", "CSAFPID-31027" ] } ], "title": "CVE-2021-21000" }, { "cve": "CVE-2021-21001", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "notes": [ { "audience": "all", "category": "description", "text": "On WAGO PFC200 devices in different firmware versions with special crafted packets an authorised attacker with network access to the device can access the file system with higher privileges.", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021", "CSAFPID-31022", "CSAFPID-31023", "CSAFPID-31024", "CSAFPID-31025", "CSAFPID-31026", "CSAFPID-31027" ] }, "remediations": [ { "category": "mitigation", "details": "If an immediate firmware update is not possible, the WLAN on the unit can also be switched off as a precautionary measure.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "Endress+Hauser provides updated firmware versions for all related products from the Proline portfolio which fixes the vulnerability and recommends customers to update to the new fixed version. For support, please contact your local service center.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "environmentalScore": 6.5, "environmentalSeverity": "MEDIUM", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 6.5, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021", "CSAFPID-31022", "CSAFPID-31023", "CSAFPID-31024", "CSAFPID-31025", "CSAFPID-31026", "CSAFPID-31027" ] } ], "title": "CVE-2021-21001" }, { "cve": "CVE-2021-30187", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "audience": "all", "category": "description", "text": "CODESYS V2 runtime system SP before 2.4.7.55 has Improper Neutralization of Special Elements used in an OS Command.", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021", "CSAFPID-31022", "CSAFPID-31023", "CSAFPID-31024", "CSAFPID-31025", "CSAFPID-31026", "CSAFPID-31027" ] }, "remediations": [ { "category": "mitigation", "details": "If an immediate firmware update is not possible, the WLAN on the unit can also be switched off as a precautionary measure.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "Endress+Hauser provides updated firmware versions for all related products from the Proline portfolio which fixes the vulnerability and recommends customers to update to the new fixed version. For support, please contact your local service center.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "environmentalScore": 5.3, "environmentalSeverity": "MEDIUM", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 5.3, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021", "CSAFPID-31022", "CSAFPID-31023", "CSAFPID-31024", "CSAFPID-31025", "CSAFPID-31026", "CSAFPID-31027" ] } ], "title": "CVE-2021-30187" } ] }