Summary
Two remote stack buffer overflow vulnerabilities were discovered in WAGO industrial switches. These issues originate from unsafe input handling in custom HTTP request parsing functions within the lighttpd binary. The affected binary lacks modern security features such as PIE and RELRO, increasing the risk of successful exploitation.
Details
Impact
The vulnerabilities are exploitable without authentication and may allow remote code execution or cause denial of service. Exploitation can disable the web interface until manual intervention, as no automatic recovery mechanisms are in place.
Remediation
Please update your devices to the specified fixed firmware version 02.64.
Vulnerabilities 2
-
Critical 9.8
Stack-based buffer overflow via unsafe sscanf in check_account()
An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_account() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise.
-
Critical 9.8
Stack-based buffer overflow via unsafe sscanf in check_cookie()
An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_cookie() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise.
Revision history
-
#1.2.0
Updated model numbers.
-
#1.1.0
Updated CVSS-Scores
-
#1.0.0
Initial release.
References
-
WAGO PSIRT
https://www.wago.com/de-en/automation-technology/psirt
-
CERT@VDE Security Advisories for WAGO
https://certvde.com/de/advisories/vendor/wago/
-
VDE-2025-095: WAGO: Vulnerabilities in WAGO Industrial-Managed Switches - HTML
https://certvde.com/en/advisories/VDE-2025-095