WAGO Industrial Managed Switches 852-303, 852-1305, and 852-1505
An attacker with access to the hard-coded credentials may gain access to the operating system of the managed switch with root privileges, which may allow manipulation of the operating system of the managed switch.CVE-2019-12550 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). An attacker with access to the hard-coded SSH key may disrupt communication or compromise the managed switch. The SSH-keys cannot be regenerated by users and all switches use the same key. CVE-2019-12549 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).. 3.2.3 USING COMPONENTS WITH KNOWN VULNERABILITIES 3.2.3 USING COMPONENTS WITH KNOWN VULNERABILITIES. The listed managed switches use outdated third-party components with known vulnerabilities. See the full list of CVE identifiers in CERT@VDE advisory number VDE-2019-013.CVE-2019-12549 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).