CVE-2021-20994 : Exploit Details and Defense Strategies

A Cross-site Scripting (XSS) vulnerability has been identified in multiple managed switches by WAGO, allowing an attacker to inject malicious code into the Web-Based Management system by tricking a legitimate user.

Understanding CVE-2021-20994

This vulnerability affects several WAGO managed switches, potentially leading to significant security issues.

What is CVE-2021-20994?

The CVE-2021-20994 vulnerability in WAGO managed switches enables attackers to execute a Cross-site Scripting (XSS) attack through the Web-Based Management interface.

The Impact of CVE-2021-20994

With a CVSS base score of 8.8 (High), this vulnerability poses a severe threat, allowing attackers to compromise the confidentiality, integrity, and availability of the affected systems.

Technical Details of CVE-2021-20994

This section provides in-depth technical information regarding the vulnerability.

Vulnerability Description

WAGO managed switches are susceptible to reflected Cross-site Scripting (XSS) attacks, enabling malicious code injection via the Web-Based Management system.

Affected Systems and Versions

The following products and versions are impacted:

0852-0303 (<= V1.2.3.S0)
0852-1305 (<= V1.1.7.S0)
0852-1505 (<= V1.1.6.S0)
0852-1305/000-001 (<= V1.0.4.S0)
0852-1505/000-001 (<= V1.0.4.S0)

Exploitation Mechanism

Attackers can exploit this vulnerability by manipulating a legitimate user into clicking a malicious link, resulting in the injection of harmful code.

Mitigation and Prevention

To safeguard systems from CVE-2021-20994, immediate actions and long-term security practices are crucial.

Immediate Steps to Take

Disable the web server of the device
Use the Command Line Interface (CLI) for device commissioning
Update the device firmware to the latest version
Restrict network access and avoid direct internet connections

Long-Term Security Practices

Implement security best practices, perform regular security audits, and educate users on safe browsing habits to prevent similar vulnerabilities in the future.

Patching and Updates

WAGO has released firmware updates to address the CVE-2021-20994 vulnerability. The following firmware versions resolve the issue:

0852-0303 (HW < 3): V1.2.5.S0
0852-0303 (HW >= 3): V1.2.3.S1
0852-1305: V1.1.8.S0
0852-1505: V1.1.7.S0
0852-1305/000-001: V1.1.4.S0
0852-1505/000-001: V1.1.4.S0