Skip to content
OpenAdvisories
High VDE-2023-044 1 CVE

Wago: Vulnerabilities in IEC61850 Server / Telecontrol

Published Dec 5, 2023 · Updated Dec 5, 2023

Vendor: WAGO Product: Telecontrol Configurator Product: WagoAppRTU

Summary

The Library WagoAppRTU which is part of the Wago Telecontrol Configurator is prone to improper input validation. By sending specifically crafted MMS packets an attacker can trigger a denial-of-service condition.

Details

Impact
Affected devices will stop working after receiving specifically crafted packets until restart.

Mitigation
Restrict network access to the device.
Do not directly connect the device to the internet.

Remediation
A fix for WAGO Telecontrol Configurator is contained within the IEC-library WagoAppRTU 1.4.6.0 and available via Wago support. (A new release is planned for the end of the year.)

Vulnerabilities 1

  • High 7.5
    CVE-2023-5188

    WAGO Improper Input Validation in IEC61850 Server / Telecontrol

    The MMS Interpreter of WagoAppRTU in versions below 1.4.6.0 which is used by the WAGO Telecontrol Configurator is vulnerable to malformed packets. An remote unauthenticated attacker could send specifically crafted packets that lead to a denial-of-service cond…

    WAGO Telecontrol Configurator WagoAppRTU ICS / OT

Revision history

  1. #1

    Initial revision.

References