Summary
An attacker with administrative privileges which can access sensitive files, can additionally access them in an unintended, undocumented way.
Details
Impact
The user might not notice that files are accessed.
Remediation
We recommend all effected users to update to the fixed firmware versions.
Mitigation
As general security measures strongly WAGO recommends:
1. Use general security best practices to protect systems from local and network
attacks.
2. Do not allow direct access to the device from untrusted networks.
3. Update to the latest firmware according to the table in chapter solutions.
Vulnerabilities 1
-
Low 2.7
WAGO: Multiple products vulnerable to local file inclusion
On affected Wago products an remote attacker with administrative privileges can access files to which he has already access to through an undocumented local file inclusion. This access is logged in a different log file than expected.
Revision history
-
#2
The fixed versions have been updated, because the previously mentioned versions are still vulnerable to this issue. More details have been added to the hardware devices. More affected version numbers were added to the firmwares.
-
#1
Final document.
References
-
WAGO PSIRT
https://www.wago.com/de-en/automation-technology/psirt
-
CERT@VDE Security Advisories for WAGO
https://certvde.com/de/advisories/vendor/wago/
-
VDE-2023-046: WAGO: Multiple products vulnerable to local file inclusion - HTML
https://certvde.com/en/advisories/VDE-2023-046