WAGO: Unauthenticated command execution via Web-based-management UPDATE A

Impact
Exploiting the vulnerability provides arbitrary command execution with privileges of the 'www' user. Via this flaw an attacker can change device configuration, create users or even take over the system.

Mitigation
As general security measures strongly WAGO recommends:

Use general security best practices to protect systems from local and network attacks.
Do not allow direct access to the device from untrusted networks.
Update to the latest firmware according to the table in chapter solutions.
Industrial control systems (ICS) should not be directly accessible from the Internet, but should be protected by consistently applying the defense-in-depth strategy.

The BSI provides general information on securing ICS in the ICS Compendium (https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/ICS/ICS-Security_compendium.pdf).

Remediation
Wago recommends all affected users to update to the firmware version listed below:

| Article No° | Product Name | Fixed Version |
|----------------------|------------------------------|----------------------------------|
| 751-9301 | Compact Controller CC100 | FW24 |
| 752-8303/8000-002 | Edge Controller | FW22 |
| 752-8303/8000-002 | Edge Controller | FW24 |
| 750-81xx/xxx-xxx | PFC100 | FW22 SP1 |
| 750-82xx/xxx-xxx | PFC200 | FW22 SP1 l |
| 750-821x/xxx-xxx | PFC200 | FW24 |
| 762-5xxx | Touch Panel 600 Advanced Line| FW22 SP1 |
| 762-5xxx | Touch Panel 600 Advanced Line| FW24 |
| 762-6xxx | Touch Panel 600 Marine Line | FW22 SP1 |
| 762-6xxx | Touch Panel 600 Marine Line | FW24 |
| 762-4xxx | Touch Panel 600 Standard Line| FW22 SP1 |
| 762-4xxx | Touch Panel 600 Standard Line| FW24 |