Summary
The Cloud Connectivity of the WAGO PLCs is used to connect the device with the cloud services from different providers. It also supports maintenance functionality with the firmware update function from the WAGO cloud.
An attacker needs an authorized login with administrative privileges on the device in order to exploit the mentioned vulnerabilities.
Details
Impact
These vulnerabilities allow an attacker which has admin privileges, an Azure cloud account and access to the device to redirect the cloud connection. With thus he is able to get sensitive data.
Mitigation
Follow the instructions in WAGOs handbook Cyber Security for Controller
Restrict network access to the device.
Do not directly connect the device to the internet
Remediation
Use strong passwords for all user accounts, especially for administrative user accounts on the device.
Vulnerabilities 4
-
Unscored —
An exploitable command injection vulnerability exists in the cloud connectivity feature of WAGO PFC200. An attacker can…
-
Unscored —
An exploitable command injection vulnerability exists in the cloud connectivity functionality of WAGO PFC200 versions 0…
-
Unscored —
An exploitable command injection vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 Firmware v…
-
Unscored —
An exploitable improper host validation vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 Fir…
Revision history
-
#2
Fix: version space, added distribution
-
#1
initial revision
References
-
WAGO GmbH & Co. KG
https://www.wago.com/psirt
-
CERT@VDE Security Advisories
https://certvde.com/en/advisories/vendor/wago/
-
VDE-2020-008: WAGO: Cloud Connectivity Multiple Vulnerabilities - HTML
https://certvde.com/en/advisories/VDE-2020-008/