Back to overview

WAGO: Authentication Bypass Vulnerability in WAGO 750-36X and WAGO 750-8XX Version <= FW03

VDE-2020-028
Last update
05/14/2025 15:00
Published at
09/30/2020 13:08
Vendor(s)
WAGO GmbH & Co. KG
External ID
VDE-2020-028
CSAF Document
Download

Summary

The Web-Based Management (WBM) of WAGOs programmable logic controller (PLC) is typically used for administration, commissioning and updates.
With special crafted requests it is possible to change some special parameters without authentication.

Impact

This vulnerability allows an attacker who has access to the WBM and knowledge about the directory structure from the WBM to change the parameter setting of the devices by sending specifically constructed requests without authentication.
This can lead to malfunction of the application after reboot.

Affected Product(s)

Model no. Product name Affected versions
750-362 750-362 Firmware <=FW03
750-363 750-363 Firmware <=FW03
750-823 750-823 Firmware <=FW03
750-832/xxx-xxx 750-832/xxx-xxx Firmware <=FW03
750-862 750-862 Firmware <=FW03
750-890/0xx-xxx 750-890/0xx-xxx Firmware <=FW03
750-891 750-891 Firmware <=FW03

Vulnerabilities

Expand / Collapse all

Published
09/22/2025 14:58
Severity
9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weakness
Improper Authentication (CWE-287)
Summary

Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW03 allows an attacker to change the settings of the devices by sending specifically constructed requests without authentication This issue affects: WAGO 750-362 version FW03 and prior versions. WAGO 750-363 version FW03 and prior versions. WAGO 750-823 version FW03 and prior versions. WAGO 750-832/xxx-xxx version FW03 and prior versions. WAGO 750-862 version FW03 and prior versions. WAGO 750-891 version FW03 and prior versions. WAGO 750-890/xxx-xxx version FW03 and prior versions.

References
cve.org | nvd.nist.gov

Mitigation

  • Restrict network access to the device.
  • Do not directly connect the device to the internet.
  • Disable unused TCP/UDP ports.
  • Disable web-based management ports 80/443 after the configuration phase

Revision History

Version Date Summary
1 09/30/2020 13:08 initial revision
2 04/10/2025 15:00 Fixed csaf reference URL
3 05/14/2025 15:00 Fix: added distribution