Skip to content
OpenAdvisories
High VDE-2023-005 1 CVE

WAGO: Series 750-3x/-8x prone to MODBUS server DoS

Published Jun 25, 2023 · Updated Jun 25, 2023

Vendor: WAGO Product: BACnet/IP Controller (4th Gen) Product: BACnet/IP Fieldbus Coupler (4th Gen) Product: EtherNet/IP Controller (4th Gen) Product: EtherNet/IP Fieldbus Coupler (4th Gen) Product: EtherNet/IP M12 Fieldbus Coupler (4th Gen) Product: Hardware Product: Modbus TCP Controller (4th Gen) Product: Modbus TCP Fieldbus Coupler (4th Gen) Product: Modbus TCP M12 Fieldbus Coupler (4th Gen)

Summary

An unauthenticated attacker with network access to port 502/TCP of the target device can cause a denial-of-service condition by sending multiple specially crafted packets. The MODBUS server does not properly release memory resources that were reserved for incomplete connection attempts by MODBUS clients. This could allow a remote attacker to generate a denial of service condition on devices that incorporate a vulnerable version of the MODBUS server.

Details

Impact
Abusing this vulnerability an attacker can crash an affected product, which fully prevents the product to work as intended. After a complete restart the component works as expected.

Mitigation
In case no MODBUS communication is needed the MODBUS-Server should be deactivated in the product settings of the web-based management.

As general security measures WAGO strongly recommends:

1. Use general security best practices to protect systems from local and network attacks.
2. Do not allow direct access to the device from untrusted networks.
3. Update to the latest firmware according to the table in chapter solutions.
4. Industrial control systems (ICS) should not be directly accessible from the Internet, but should be protected by consistently applying the defense-in-depth strategy. The BSI provides general information on securing ICS in the ICS Compendium (www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/ICS/ICS-Security_compendium.pdf).

Remediation
We recommend all affected users to update to the firmware version listed below:

### Series WAGO 750-3x/-8x

| Article Number | Fixed in Firmware Version |
|----------------------|----------------------------------------|
| 750-332 | FW11 after BACnet certification |
| 750-362/xxx-xxx | FW11 Q3/2023 |
| 750-363/xxx-xxx | FW11 Q3/2023 |
| 750-364/xxx-xxx | FW11 Q3/2023 |
| 750-365/xxx-xxx | FW11 Q3/2023 |
| 750-823 | FW11 Q3/2023 |
| 750-832/xxx-xxx | FW11 after BACnet certification |
| 750-862 | FW11 Q1/2023 |
| 750-890/xxx-xxx | FW11 Q3/2023 |
| 750-891 | FW11 Q3/2023 |
| 750-893 | FW11 Q3/2023 |

Vulnerabilities 1

  • High 7.5
    CVE-2023-1150

    WAGO: Series 750-3x/-8x prone to MODBUS server DoS

    Uncontrolled resource consumption in Series WAGO 750-3x/-8x products may allow an unauthenticated remote attacker to DoS the MODBUS server with specially crafted packets.

    WAGO 750-891 750-823 750-832/xxx-xxx ICS / OT

Revision history

  1. #1

    Initial revision.

References