Summary
An unauthenticated attacker with network access to port 502/TCP of the target device can cause a denial-of-service condition by sending multiple specially crafted packets. The MODBUS server does not properly release memory resources that were reserved for incomplete connection attempts by MODBUS clients. This could allow a remote attacker to generate a denial of service condition on devices that incorporate a vulnerable version of the MODBUS server.
Impact
Abusing this vulnerability an attacker can crash an affected product, which fully prevents the product to work as intended. After a complete restart the component works as expected.
Affected Product(s)
| Model no. | Product name | Affected versions |
|---|---|---|
| 750-832/xxx-xxx | BACnet/IP Controller (4th Gen) | Fimware <=FW10 |
| 750-332 | BACnet/IP Fieldbus Coupler (4th Gen) | Fimware <=FW10 |
| 750-823, 750-893 | EtherNet/IP Controller (4th Gen) | Fimware <=FW10 |
| 750-363/xxx-xxx | EtherNet/IP Fieldbus Coupler (4th Gen) | Fimware <=FW10 |
| 750-365/xxx-xxx | EtherNet/IP M12 Fieldbus Coupler (4th Gen) | Fimware <=FW10 |
| 750-862, 750-890/xxx-xxx, 750-891 | Modbus TCP Controller (4th Gen) | Fimware <=FW10 |
| 750-362/xxx-xxx | Modbus TCP Fieldbus Coupler (4th Gen) | Fimware <=FW10 |
| 750-364/xxx-xxx | Modbus TCP M12 Fieldbus Coupler (4th Gen) | Fimware <=FW10 |
Vulnerabilities
Expand / Collapse allUncontrolled resource consumption in Series WAGO 750-3x/-8x products may allow an unauthenticated remote attacker to DoS the MODBUS server with specially crafted packets.
Mitigation
In case no MODBUS communication is needed the MODBUS-Server should be deactivated in the product settings of the web-based management.
As general security measures WAGO strongly recommends:
- Use general security best practices to protect systems from local and network attacks.
- Do not allow direct access to the device from untrusted networks.
- Update to the latest firmware according to the table in chapter solutions.
- Industrial control systems (ICS) should not be directly accessible from the Internet, but should be protected by consistently applying the defense-in-depth strategy. The BSI provides general information on securing ICS in the ICS Compendium (www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/ICS/ICS-Security_compendium.pdf).
Remediation
We recommend all affected users to update to the firmware version listed below:
Series WAGO 750-3x/-8x
| Article Number | Fixed in Firmware Version |
|---|---|
| 750-332 | FW11 after BACnet certification |
| 750-362/xxx-xxx | FW11 Q3/2023 |
| 750-363/xxx-xxx | FW11 Q3/2023 |
| 750-364/xxx-xxx | FW11 Q3/2023 |
| 750-365/xxx-xxx | FW11 Q3/2023 |
| 750-823 | FW11 Q3/2023 |
| 750-832/xxx-xxx | FW11 after BACnet certification |
| 750-862 | FW11 Q1/2023 |
| 750-890/xxx-xxx | FW11 Q3/2023 |
| 750-891 | FW11 Q3/2023 |
| 750-893 | FW11 Q3/2023 |
Revision History
| Version | Date | Summary |
|---|---|---|
| 1 | 25.06.2023 08:00 | Initial revision. |