Share: Email | Twitter

ID

VDE-2025-004

Published

2025-03-05 12:00 (CET)

Last update

2025-03-05 10:04 (CET)

Vendor(s)

WAGO GmbH & Co. KG

Product(s)

Article No° Product Name Affected Version(s)
CC100 0751-9x01 < 04.07.01 (FW29)
CC100 0751-9x01 < 04.07.01 (70)
Edge Controller 0752-8303/8000-0002 < 04.07.01 (FW29)
Edge Controller 0752-8303/8000-0002 < 04.07.01 (70)
PFC100 G1 0750-810x/xxxx-xxxx < 3.10.11 (FW22 Patch 2)
PFC100 G1 0750-810x/xxxx-xxxx < 04.07.01 (70)
PFC100 G2 0750-811x-xxxx-xxxx < 04.07.01 (FW29)
PFC100 G2 0750-811x-xxxx-xxxx < 04.07.01 (70)
PFC200 G1 750-820x-xxx-xxx < 3.10.11 (FW22 Patch 2)
PFC200 G1 750-820x-xxx-xxx < 04.07.01 (70)
PFC200 G2 750-821x-xxx-xxx < 04.07.01 (FW29)
PFC200 G2 750-821x-xxx-xxx < 04.07.01 (70)
TP600 0762-420x/8000-000x < 04.07.01 (FW29)
TP600 0762-420x/8000-000x < 04.07.01 (70)
TP600 0762-430x/8000-000x < 04.07.01 (FW29)
TP600 0762-430x/8000-000x < 04.07.01 (70)
TP600 0762-520x/8000-000x < 04.07.01 (FW29)
TP600 0762-520x/8000-000x < 04.07.01 (70)
TP600 0762-530x/8000-000x < 04.07.01 (FW29)
TP600 0762-530x/8000-000x < 04.07.01 (70)
TP600 0762-620x/8000-000x < 04.07.01 (FW29)
TP600 0762-620x/8000-000x < 04.07.01 (70)
TP600 0762-630x/8000-000x < 04.07.01 (FW29)
TP600 0762-630x/8000-000x < 04.07.01 (70)

Summary

Nozomi Networks reported a vulnerability in the pfc firmware sdk-G2 of libwagosnmp. The WAGO pfc-firmware-sdk-G2 is a software development kit designed for WAGO PFC devices which allows developers to build and customize the firmware.

CVE ID

CVE-2024-12650

Last Update:

5. März 2025 09:05

Severity

5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) 

Weakness

Unchecked Return Value  (CWE-252) 

Summary

An attacker with low privileges can manipulate the requested memory size, causing the application to use an invalid memory area. This could lead to a crash of the application but it does not affected other applications.

Details

certvde.com 

Impact

If the requested memory size could not be allocated by the underlying operating system, the application uses an invalid memory area. This could lead to a crash of the application.

Solution

Remediation

Update to Firmware 4.7.1 (FW29), Firmware 03.10.11. For the latest Custom Firmware, please contact the WAGO support.

Reported by

CERT@VDE coordinated with Wago

Reporting: Gabriele Quagliarella from Nozomi Networks