CVE-2021-20994

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

In multiple managed switches by WAGO in different versions an attacker may trick a legitimate user to click a link to inject possible malicious code into the Web-Based Management.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
WAGO	0852-0303	>= unspecified, <= V1.2.3.S0
WAGO	0852-1305	>= unspecified, <= V1.1.7.S0
WAGO	0852-1505	>= unspecified, <= V1.1.6.S0
WAGO	0852-1305/000-001	>= unspecified, <= V1.0.4.S0
WAGO	0852-1505/000-001	>= unspecified, <= V1.0.4.S0

References

https://cert.vde.com/en-us/advisories/vde-2021-013Third Party Advisory
https://cert.vde.com/en-us/advisories/vde-2021-013Third Party Advisory

Timeline

Published: May 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-209957.5In multiple managed switches by WAGO in different versions the webserver cookies of the web based UI contain user credentials.CVE-2021-209965.3In multiple managed switches by WAGO in different versions special crafted requests can lead to cookies being transferred to third parties.CVE-2021-209977.5In multiple managed switches by WAGO in different versions it is possible to read out the password hashes of all Web-based Management users.CVE-2021-209989.8In multiple managed switches by WAGO in different versions without authorization and with specially crafted packets it is possible to create CVE-2021-209999.8In Weidmüller u-controls and IoT-Gateways in versions up to 1.12.1 a network port intended only for device-internal usage is accidentally ac CVE-2021-21009.1Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Print Server). Supported versions that are CVE-2021-210007.5On WAGO PFC200 devices in different firmware versions with special crafted packets an attacker with network access to the device could cause CVE-2021-210016.5On WAGO PFC200 devices in different firmware versions with special crafted packets an authorised attacker with network access to the device CVE-2021-210027.5In Phoenix Contact FL COMSERVER UNI in versions < 2.40 a invalid Modbus exception response can lead to a temporary denial of service.CVE-2021-210035.3In Phoenix Contact FL SWITCH SMCS series products in multiple versions fragmented TCP-Packets may cause a Denial of Service of Web-, SNMP- a CVE-2021-210046.1In Phoenix Contact FL SWITCH SMCS series products in multiple versions an attacker may insert malicious code via LLDP frames into the web-ba CVE-2021-210057.5In Phoenix Contact FL SWITCH SMCS series products in multiple versions if an attacker sends a hand-crafted TCP-Packet with the Urgent-Flag s