Summary
Several WAGO Firmwares are vulnerable to a to a remote attack which allows to bypass the integrity check through OpenSSH. This called Terrapin attack occurs because of mishandled handshake phase.
Details
Impact
The Terrapin attack vulnerability in the SSH transport protocol poses a risk by allowing remote attackers to compromise the integrity of connections, potentially leading to the downgrade or disablement of critical security features.
Remediation
A fix for the affected Firmwares will be provided with the following firmware versions:
- FW22, Patch 2 installed on 750-810x
- FW22, Patch 2 installed on 750-821x
- FW22, Patch 2 installed on 762-4x0x
- FW22, Patch 2 installed on 762-5x0x
- FW22, Patch 2 installed on 762-6x0x
- FW22, Patch 2 installed on 752-8303
- FW27 installed on 750-811x
- FW27 installed on 750-821x
- FW27 installed on 751-9301
- FW27 installed on 751-9401
- FW27 installed on 762-4x0x
- FW27 installed on 762-5x0x
- FW27 installed on 762-6x0x
- FW27 installed on 752-8303
- Custom Firmware 03.03.08 (80) installed on 750-820x
- Custom Firmware 04.03.03 (72) installed on 751-9301
- Custom Firmware 04.03.03 (72) installed on 751-9401
- Custom Firmware 04.04.03 (70) installed on 750-821x
Vulnerabilities 1
-
Medium 5.9
Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server…
Revision history
-
#2
Fix: version space
-
#1
Initial revision.
References
-
VDE-2024-014: WAGO: Multiple products affected by Terrapin - HTML
https://certvde.com/en/advisories/VDE-2024-014/
-
Vendor PSIRT
https://www.wago.com/psirt
-
CERT@VDE Security Advisories for WAGO GmbH & Co. KG
https://certvde.com/en/advisories/vendor/wago/