Summary
Pepperl+Fuchs analyzed WirelessHART-Gateways in respect of a critical vulnerability within the Firmware. An attacker may exploit this vulnerability to get access to files and access restricted directories that are stored on the device by manipulating file parameters that reference these. Incoming HTTP requests using fcgi-bin/wgsetcgi and a filename parameter allow a directory / path traversal. A publicly available exploit already exists for this vulnerability.
Details
Impact
Successful vulnerability exploitation enables remote, unauthenticated attackers to gain unauthorized access to arbitrary files on WirelessHART-Gateways. This includes applications, data, credentials and sensitive operating system files.
Remediation
A Firmware (version see table below), which solves the problem, is available.
Please contact your support representative for this particular firmware package and update the corresponding product.
| Product ID | Version | Bus-Interface of Device |
|-----------------|----------|-------------------------|
| WHA-GW-*-ETH | 03.00.08 | Modbus |
| WHA-GW-*-ETH.EIP | 02.00.01 | Ethernet/IP |
Vulnerabilities 1
-
Unscored —
Endress+Hauser WirelessHART Fieldgate SWG70 3.x devices allow Directory Traversal via the fcgi-bin/wgsetcgi filename pa…
Revision history
-
#4
Fix: added distribution
-
#3
Fix: Version, Remediation
-
#2
Fix: correct certvde domain, added self-reference
-
#1
Initial revision.
References
-
CERT@VDE Security Advisories for Pepperl+Fuchs
https://certvde.com/en/advisories/vendor/pepperl+fuchs/
-
VDE-2019-002: Pepperl+Fuchs: Path traversal in WirelessHART Gateway - HTML
https://certvde.com/en/advisories/VDE-2019-002