WAGO: FTP-Server - Denial-of-Service

The FTP server does not properly release memory resources that were reserved for incomplete connection attempts by FTP clients. This could allow a remote attacker to generate a denial of service condition on devices that incorporate a vulnerable version of the FTP server.See also: Siemens Advisory published October 11th, 2022 - SSA-313313

Abusing this vulnerability an attacker can crash an affected product, which fully prevents the product to work as intended. After a complete restart the component works as expected.

If you enabled the FTP-Server, but you do not need FTP data transfer, you can deactivate the FTP Server over the product settings in the web-based management.

As general security measures strongly WAGO recommends:

1. Use general security best practices to protect systems from local and network attacks.

2. Do not allow direct access to the device from untrusted networks.

3. Update to the latest firmware according to the table in chapter solutions.

4. Industrial control systems (ICS) should not be directly accessible from the Internet, but should be protected by consistently applying the defense-in-depth strategy.
   The BSI provides general information on securing ICS in the ICS Compendium (https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/ICS/ICS-Security_compendium.pdf external link).

Wago recommends all effected users to update to the firmware version listed below:

Series WAGO 750-3x / -8x