Summary
The vulnerability in the Ethernet switch circuit is caused by a PullUp resistor at the reset input, leading to premature activation and undefined operation. Switching to a PullDown resistor keeps the switch in reset. This issue affects the CC100, the Touch Panels 600 and the Edge Controller.
Details
Impact
The vulnerability causes the Ethernet switch to operate in an undefined state due to early activation, leading to unstable system behavior and potential connectivity issues.
Remediation
To address this vulnerability, it is recommended to utilize a newer hardware revision equipped with Firmware 04.08.05 (FW30). This firmware version is designed to resolve the issue by properly managing the switch activation and configuration process on the revised hardware. It is important to note that older firmware versions will not resolve the problem on the new hardware revision, and therefore upgrading both the hardware and firmware is necessary for an effective remediation.
Vulnerabilities 1
-
Medium 6.5
WAGO: Vulnerability in hardware switch circuit
During a short time frame while the device is booting an unauthenticated remote attacker can send traffic to unauthorized networks due to the switch operating in an undefined state until a CPU-induced reset allows proper configuration.
Revision history
-
#1.0.0
Initial revision.
References
-
WAGO PSIRT
https://www.wago.com/de-en/automation-technology/psirt
-
CERT@VDE Security Advisories for WAGO
https://certvde.com/de/advisories/vendor/wago/
-
VDE-2025-083: WAGO: Vulnerability in hardware switch circuit - HTML
https://certvde.com/en/advisories/VDE-2025-083