Summary
With special crafted requests it is possible to get sensitive information, in this case the password hashes, by measuring response delay. With a substantial amount of time this data can be used to calculate the passwords of the Web-Based Management users. In case of CVE 2019-5134, the password salt can also be extracted.
Details
Impact
These vulnerabilities allow an experienced attacker who has access to the WBM to reconstruct the passwords hashes of the WBM users by sending specifically constructed requests.
Remediation
Use strong passwords for all user accounts, especially for administrative user accounts on the device.
Follow the instructions in WAGOs handbook Cyber Security for Controller
Restrict network access to the device.
Do not directly connect the device to the internet
Disable unused TCP/UDP-ports
Solution
Update the devices to standard firmware 15.
Vulnerabilities 2
-
Unscored —
An exploitable regular expression without anchors vulnerability exists in the Web-Based Management (WBM) authentication…
-
Unscored —
An exploitable timing discrepancy vulnerability exists in the authentication functionality of the Web-Based Management …
Revision history
-
#3
Fix: firmware category, version space, added distribution
-
#2
Fix: correct certvde domain, added self-reference
-
#1
Initial revision.
References
-
CERT@VDE Security Advisories for WAGO
https://certvde.com/en/advisories/vendor/wago/
-
VDE-2020-006: WAGO: Web-Based Management Authentication Vulnerabilities - HTML
https://certvde.com/en/advisories/VDE-2020-006/