Summary
The Web-Based Management (WBM) of WAGOs programmable logic controller (PLC) is typically used for administration, commissioning and updates.
With special crafted requests it is possible to change some special parameters without authentication.
Details
Impact
This vulnerability allows an attacker who has access to the WBM to prevent the loading of the runtime-application after restart of the device by sending specifically constructed requests without authentication.
Solution
Upgrade affected devices to the latest standard firmware.
| Product | Fixed Versions |
|-------------------|----------------|
| 750-852 | > FW07 |
| 750-880/xxx-xxx | > FW07 |
| 750-881 | > FW07 |
| 750-831/xxx-xxx | > FW07 |
| 750-882 | > FW07 |
| 750-885/xxx-xxx | > FW07 |
| 750-889 | > FW07 |
Mitigation
Restrict network access to the device.
Do not directly connect the device to the internet.
Disable unused TCP/UDP ports.
Disable web-based management ports 80/443 after the configuration phase
Vulnerabilities 1
-
High 8.2
WAGO: Vulnerability in web-based authentication in WAGO 750-8XX Version <= FW07
Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW07 allows an attacker to change some special parameters without authentication. This issue affects: WAGO 750-852, WAGO 750-880/xxx-xxx, WAGO 750-881, WAGO 750-831/xxx-xxx, WAGO …
Revision history
-
#2
Fix: removed ia, firmware category, added distribution
-
#1
Initial revision.
References
-
VDE-2020-027: WAGO: Vulnerability in web-based authentication in WAGO 750-8XX Version <= FW07 - HTML
https://certvde.com/de/advisories/VDE-2020-027/
-
CERT@VDE Security Advisories for WAGO GmbH & Co. KG
https://certvde.com/en/advisories/vendor/wago