Summary
The Web-Based Management (WBM) of WAGOs programmable logic controller (PLC) is typically used for administration, commissioning, and updates.
The option to change the configuration data via tools or the web-based-management enabled attackers to prepare cross-site-scripting attacks and under specific circumstances perform remote code execution.
Details
Impact
The web-based management of affected products is vulnerable to Reflective Cross-Site Scripting. This can be used to install malicious code and to gain access to confidential information on a System that connects to the WBM after it has been compromised.
Additionally, the affected products contain a buffer overflow vulnerability which enables attackers to remotely execute code, which could lead to compromise of data and execution of malicious code.
Mitigation
If not needed, you can deactivate the web-based management to prevent attacks (command line). Disableunused TCP/UDP-ports. Restrict network access to the device. Do not directly connect the device to theinternet.
Remediation
A fix for the affected firmwares will be provided with the following firmware versions:
- FW14 installed on 750-352/xxx-xxx
- FW14 installed on 750-88x/xxx-xxx
- FW14 installed on 750-852
No fix planned for products:
<= FW13 installed on 750-831/xxx-xxx
<= FW13 installed on 750-829
Vulnerabilities 2
-
High 8.8
Wago: Buffer Copy without Checking Size of Input in wbm of multiple products
An unautheticated remote attacker could send specifically crafted packets to a affected device. If an authenticated user then views that data in a specific page of the web-based management a buffer overflow will be triggered to gain full access of the device.
-
Medium 5.4
Wago: Improper Neutralization of Input During Web Page Generation in multiple devices
An unauthenticated remote attacker can use an XSS attack due to improper neutralization of input during web page generation. User interaction is required. This leads to a limited impact of confidentiality and integrity but no impact of availability.
Revision history
-
#1
Initial revision.
References
-
VDE-2023-039: Wago: Multiple vulnerabilities in web-based management of multiple products - HTML
https://certvde.com/en/advisories/VDE-2023-039/
-
Vendor PSIRT
https://www.wago.com/psirt
-
CERT@VDE Security Advisories for WAGO GmbH & Co. KG
https://certvde.com/en/advisories/vendor/wago/