Share: Email | Twitter

ID

VDE-2020-027

Published

2020-09-30 13:06 (CEST)

Last update

2020-09-30 13:06 (CEST)

Vendor(s)

WAGO GmbH & Co. KG

Product(s)

Article No° Product Name Affected Version(s)
750-831/xxx-xxx <= FW07
750-852 <= FW07
750-880/xxx-xxx <= FW07
750-881 <= FW07
750-882 <= FW07
750-885/xxx-xxx <= FW07
750-889 <= FW07

Summary

The Web-Based Management (WBM) of WAGOs programmable logic controller (PLC) is typically used for administration, commissioning and updates.
With special crafted requests it is possible to change some special parameters without authentication.

CVE ID

CVE-2020-12505 

Last Update:

7. Oktober 2020 07:47

Severity

8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) 

Weakness

Improper Authentication  (CWE-287) 

Summary

Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW07 allows an attacker to change some special parameters without authentication. This issue affects: WAGO 750-852 version FW07 and prior versions. WAGO 750-880/xxx-xxx version FW07 and prior versions. WAGO 750-881 version FW07 and prior versions. WAGO 750-831/xxx-xxx version FW07 and prior versions. WAGO 750-882 version FW07 and prior versions. WAGO 750-885/xxx-xxx version FW07 and prior versions. WAGO 750-889 version FW07 and prior versions.

Details

nvd.nist.gov 

Impact

This vulnerability allows an attacker who has access to the WBM to prevent the loading of the runtime-application after restart of the device by sending specifically constructed requests without authentication.

Solution

Upgrade affected devices to the latest standard firmware.

Product Fixed Versions
750-852 > FW07
750-880/xxx-xxx > FW07
750-881 > FW07
750-831/xxx-xxx > FW07
750-882 > FW07
750-885/xxx-xxx > FW07
750-889 > FW07

Mitigation

  • Restrict network access to the device.
  • Do not directly connect the device to the internet.
  • Disable unused TCP/UDP ports.
  • Disable web-based management ports 80/443 after the configuration phase

Reported by

Maxim Rupp reported this vulnerability to WAGO.

CERT@VDE coordinated.