Summary
There is a misconfiguration of access rights to a configuration tool of the web-based-management for a specific user, which allows to reset passwords of other users (except root). This allows an authenticated attacker to elevate his privileges.
Details
Impact
An authenticated attacker can get further privileges allowing the attacker to change configuration and perform actions beyond the original user scope.
Mitigation
Restrict network access to the device.
Do not directly connect the device to the internet.
Remediation
Wago recommends all affected users to update to the firmware version listed below:
### Series WAGO PFC100/PFC200 and WAGO Compact Controller CC100
| Article Number | Fixed in Firmware Version |
|-----------------------|----------------------------------|
| 750-811x/xxx-xxx | FW22 Patch 2 |
| 750-821x/xxx-xxx | FW26 |
| 750-820x/xxx-xxx | FW22 Patch 2 |
| 751-9301 | FW26 |
### Series WAGO Touch Panel 600 and WAGO Edge Controller
| Article Number | Fixed in Firmware Version |
|-----------------------|----------------------------------|
| 762-4xxx | FW26 |
| 762-5xxx | FW26 |
| 762-6xxx | FW26 |
| 752-8303/8000-002 | FW26 |
FW22 Patch 2 will be available in Q1 2024.
Vulnerabilities 1
-
Medium 5.3
WAGO: Improper Privilege Management in web-based management
Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker to change the passwords of other non-admin users and thus to escalate non-root privileges.
Revision history
-
#1
Initial revision.
References
-
VDE-2023-015: WAGO: Improper privilege management in web-based management - HTML
https://certvde.com/en/advisories/VDE-2023-015/
-
WAGO PSIRT
https://www.wago.com/psirt
-
CERT@VDE Security Advisories for WAGO GmbH & Co. KG
https://certvde.com/en/advisories/vendor/wago/