WAGO PFC200 Series

Summary

Vulnerabilities 1

• Low 2.7
  CVE-2023-4089

  WAGO: Multiple products vulnerable to local file inclusion

  On affected Wago products an remote attacker with administrative privileges can access files to which he has already access to through an undocumented local file inclusion. This access is logged in a different log file than expected.

  WAGO Compact Controller CC100 Touch Panel 600 Advanced Line Touch Panel 600 Standard Line Browsers ICS / OT
  Oct 17, 2023

Revision history

1. 2023-11-21 #1

   Initial Publication

References

• ICSA Advisory ICSA-23-325-01 - Web Version
  https://www.cisa.gov/news-events/ics-advisories/icsa-23-325-01
• Recommended Practices
  https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
• Recommended Practices
  https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
• Recommended Practices
  https://www.cisa.gov/topics/industrial-control-systems
• Recommended Practices
  https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
• Recommended Practices
  https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
• Recommended Practices
  https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B