VDE-2020-045 — WAGO: Command Injection Vulnerability in I/O-Check Service of multiple products

Summary

The reported vulnerability allows an attacker who has network access to the device to execute code with specially crafted packets.

Details

Impact
By exploiting the described vulnerabilities the attacker potentially is able to manipulate or disrupt the device.

Mitigation
* Disable I/O-Check service
* Restrict network access to the device.
* Do not directly connect the device to the internet.

Remediation
The I/O-Check service protocol is only needed during installation and commissioning, not during normal operations. It is highly recommended to disable the I/O-Check service after commissioning. This is the easiest and securest way to protect your device from the listed vulnerabilities.

Regardless to the action described above, the vulnerability has been fixed in FW11, released in December 2017.

Vulnerabilities 1

Critical 10.0

CVE-2020-12522

Command Injection Vulnerability in I/O-Check Service of WAGO PFC100, PFC200 and Touch Panel 600 Series with firmware versions <=FW10

The reported vulnerability allows an attacker who has network access to the device to execute code with specially crafted packets in WAGO Series PFC 100 (750-81xx/xxx-xxx), Series PFC 200 (750-82xx/xxx-xxx), Series Wago Touch Panel 600 Standard Line (762-4xxx…

WAGO Series PFC 100 (750-81xx/xxx-xxx) Series Wago Touch Panel 600 Standard Line (762-4xxx) Series Wago Touch Panel 600 Marine Line (762-6xxx) ICS / OT

Dec 17, 2020

Revision history

2025-05-14 #3
Fix: version space, added distribution
2024-11-06 #2
Fix: added self-reference
2020-12-17 #1
initial revision

References

WAGO GmbH & Co. KG
https://www.wago.com/psirt
CERT@VDE Security Advisories
https://certvde.com/en/advisories/vendor/wago/
VDE-2020-045: WAGO: Command Injection Vulnerability in I/O-Check Service of multiple products - HTML
https://certvde.com/en/advisories/VDE-2020-045/