Skip to content
OpenAdvisories
Critical VDE-2022-055 1 CVE

WAGO: Exposure of configuration interface in unmanaged switches

Published Feb 16, 2023 · Updated Feb 16, 2023

Vendor: WAGO Product: Unmanaged Switch

Summary

An unknown and undocumented configuration interface with limited functionality was identified on the affected devices.

Details

Impact
An unprivileged attacker can configure network setting to violate confidentiality of transferred packages if the network packages themselves are not protected by cryptographic measures. Additionally, the attacker can violate the availability of network clients by changing network settings (e.g., deactivate network ports).

Mitigation
Restrict network access to the device.
Do not directly connect the device to the internet

Remediation
A firmware update which fixes the problem is available. Users who want to do a firmware update should contact the WAGO support.

Vulnerabilities 1

  • Critical 9.1
    CVE-2022-3843

    WAGO: Exposure of configuration interface in unmanaged switches

    In WAGO Unmanaged Switch (852-111/000-001) in firmware version 01 an undocumented configuration interface without authorization allows an remote attacker to read system information and configure a limited set of parameters.

    WAGO Unmanaged Switch 852-111/000-001 ICS / OT

Revision history

  1. #1

    Initial revision.

References