CVE-2021-20993
WAGO: Managed Switches: Exposure of sensitive information through directory listing
02 Description
WAGO: Managed Switches: Exposure of sensitive information through directory listing
03 Exploitation and scoring
- Exploitation
- Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
- SSVC decision
- Not assessed by CISA
- EPSS probability
- 0.79% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 55.9% of scored records. A rank, not a probability.
- NVD base score
- 5.3 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- NVD analysis status
- Modified. NVD last modified this record on 2026-06-17.
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2021-05-13 13:45Z5 YR AGO
- Last updated
- 2024-09-16 22:46Z2 YR AGO
- Reserved
- 2020-12-17
- Assigning CNA
- CERTVDE
- Record state
- PUBLISHED
- Severity
- Medium (CVSS 5.3)
- CNA CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-200Exposure of Sensitive Information to an Unauthorized ActorClass
- Data version
- 5.1
- Document digest
- af4cfffa053add7381b46b184871fc7f6d3522c301f00e3abcc9dfc5386f1040
05 Affected products
06 References
07 Remediation
The Web-Based Management is only needed during installation and commissioning, not during normal operations. It is recommended to disable the web server after commissioning. The Command Line Interface (CLI) is an alternative for commissioning the device. This is the easiest and securest way to protect your device from the listed vulnerabilities. Regardless of the action described above, the vulnerabilities are fixed with following firmware releases: Item number [FW version] 0852-0303 (HW < 3)* [V1.2.5.S0] Detailed information about the hardware version is described in the installation guide. 0852-0303 (HW >=3)* [V1.2.3.S1] Detailed information about the hardware version is described in the installation guide. 0852-1305 [V1.1.8.S0] 0852-1505 [V1.1.7.S0] 0852-1305/000-001 [V1.1.4.S0] 0852-1505/000-001 [V1.1.4.S0]