Summary
WAGO PLCs uses Linux as operating system and offers the ambitious user the opportunity to make their own modifications to expand the functionality of the PLC. For this reason the pppd daemon is also part of the operating system but it is not activated in the default configuration of the WAGO firmware.
The reported vulnerability is only exploitable if the customer has activated the pppd daemon in his individual configuration manually. If the pppd daemon is used by the application from the customer, an unauthenticated remote attacker could cause a memory corruption in the pppd process, which may allow for arbitrary code execution, by sending an unsolicited EAP packet.
Details
Impact
By sending an unsolicited EAP packet to a vulnerable ppp client or server, an unauthenticated remote attacker could cause memory corruption in the pppd process, which may allow for arbitrary code execution. IOActive Security Advisory external link
Remediation
If pppd daemon is activated, update the device to firmware 16.
Vulnerabilities 1
-
Critical 9.8
eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.
Revision history
-
#3
Fix: firmware category, version space, added distribution
-
#2
Fix: correct certvde domain, added alias, added self-reference
-
#1
Initial revision.
References
-
CERT@VDE Security Advisories for WAGO
https://certvde.com/en/advisories/vendor/wago/
-
VDE-2020-020: WAGO: PPPD in PFC100 and PFC200 Series is vulnerable to CVE-2020-8597 - HTML
https://certvde.com/de/advisories/VDE-2020-020/