VDE-2025-004 — Wago: Vulnerability in libwagosnmp

Summary

Nozomi Networks reported a vulnerability in the pfc firmware sdk-G2 of libwagosnmp. The WAGO pfc-firmware-sdk-G2 is a software development kit designed for WAGO PFC devices which allows developers to build and customize the firmware.

Details

Impact
If the requested memory size could not be allocated by the underlying operating system, the application uses an invalid memory area. This could lead to a crash of the application.

Remediation
Update to Firmware 4.7.1 (FW29), Firmware 03.10.11. For the latest Custom Firmware, please contact the WAGO support.

Vulnerabilities 1

Medium 5.4

CVE-2024-12650

Wago: Vulnerability in libwagosnmp

An attacker with low privileges can manipulate the requested memory size, causing the application to use an invalid memory area. This could lead to a crash of the application but it does not affected other applications.

WAGO TP600 0762-630x/8000-000x TP600 0762-420x/8000-000x TP600 0762-520x/8000-000x Browsers ICS / OT

Mar 5, 2025

Revision history

2025-04-10 #2
Fixed csaf reference URL
2025-03-05 #1
Initial release.

References

WAGO PSIRT
https://www.wago.com/de-en/automation-technology/psirt
CERT@VDE Security Advisories for WAGO
https://certvde.com/de/advisories/vendor/wago/
VDE-2025-004: Wago: Vulnerability in libwagosnmp - HTML
https://certvde.com/en/advisories/VDE-2025-004