CVE-2021-34578

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically constructed requests without authentication on multiple WAGO PLCs in firmware versions up to FW07.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Aug 31, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-345797.5In Phoenix Contact: FL MGUARD DM version 1.12.0 and 1.13.0 access to the Apache web server being installed as part of the FL MGUARD DM on Mi CVE-2021-34584.6The Motorola MM1000 device configuration portal can be accessed without authentication, which could allow adapter settings to be modified.CVE-2021-345807.5In mymbCONNECT24, mbCONNECT24 <= 2.9.0 an unauthenticated user can enumerate valid backend users by checking what kind of response the serve CVE-2021-345817.5Missing Release of Resource after Effective Lifetime vulnerability in OpenSSL implementation of WAGO 750-831/xxx-xxx, 750-880/xxx-xxx, 750-8 CVE-2021-345824.8In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 a user with high privileges can inject HTML code (XSS) through CVE-2021-345837.5Crafted web server requests may cause a heap-based buffer overflow and could therefore trigger a denial-of- service condition due to a crash CVE-2021-345849.1Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service condition due to a cras CVE-2021-345857.5In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests can trigger a parser error. Since the parser result is not check CVE-2021-345867.5In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests may cause a Null pointer dereference in the CODESYS web server a CVE-2021-345875.3In Bender/ebee Charge Controllers in multiple versions a long URL could lead to webserver crash. The URL is used as input of an sprintf to a CVE-2021-345888.6In Bender/ebee Charge Controllers in multiple versions are prone to unprotected data export. Backup export is protected via a random key. Th CVE-2021-345897.5In Bender/ebee Charge Controllers in multiple versions are prone to an RFID leak. The RFID of the last charge event can be read without auth