| Article No° | Product Name | Affected Version(s) |
|---|---|---|
| WAGO CC100 0751-9x01 | <= 4.5.10 (FW27) | |
| WAGO CC100 0751/9x01 | <= 04.03.03 (72) | |
| WAGO CC100 0751/9x01 | <= 04.04.03 (70) | |
| WAGO Edge Controller 0752-8303/8000-0002 | <= 4.5.10 (FW27) | |
| WAGO PFC100 G1 0750-810x/xxxx-xxxx | <= 3.10.10 (FW22 Patch 1) | |
| WAGO PFC100 G2 0750-811x-xxxx-xxxx | <= 4.5.10 (FW27) | |
| WAGO PFC200 G1 0750-820x/xxx-xxx | <= 03.03.08 (80) | |
| WAGO PFC200 G1 750-820x-xxx-xxx | <= 3.10.10 (FW22 Patch 1) | |
| WAGO PFC200 G2 0750-821x/xxx-xxx | <= 04.04.03 (70) | |
| WAGO PFC200 G2 750-821x-xxx-xxx | <= 4.5.10 (FW27) | |
| WAGO TP600 0762-420x/8000-000x | <= 4.5.10 (FW27) | |
| WAGO TP600 0762-430x/8000-000x | <= 4.5.10 (FW27) | |
| WAGO TP600 0762-520x/8000-000x | <= 4.5.10 (FW27) | |
| WAGO TP600 0762-530x/8000-000x | <= 4.5.10 (FW27) | |
| WAGO TP600 0762-620x/8000-000x | <= 4.5.10 (FW27) | |
| WAGO TP600 0762-630x/8000-000x | <= 4.5.10 (FW27) |
Nozomi reported eight vulnerabilities to WAGO affecting different firmwares installed on several devices.
A low privileged remote attacker may modify the configuration of the CODESYS V3 service through a missing authentication vulnerability which could lead to full system access and/or DoS.
A low privileged remote attacker can specify an arbitrary file on the filesystem which may lead to an arbitrary file writes with root privileges.
A low privileged remote attacker may modify the boot mode configuration setup of the device, leading to modification of the firmware upgrade process or a denial-of-service attack.
A low privileged remote attacker can overwrite an arbitrary file on the filesystem leading to a DoS and data loss.
A low privileged remote attacker may modify the BACNet service properties due to incorrect permission assignment for critical resource which may lead to a DoS limited to BACNet communication.
A low privileged remote attacker can overwrite an arbitrary file on the filesystem which may lead to an arbitrary file read with root privileges.
A low privileged remote attacker may have access to forbidden diagnostic data due to incorrect permission assignment for critical resource.
A low privileged remote attacker may modify the docker settings setup of the device, leading to a limited DoS.
The identified vulnerabilities could lead to a denial-of-service attack or alter of the firmware and docker configuration.
Remediation
Update to Firmware 4.6.x (FW28). For G1 devices update to Firmware 3.10.11 (FW22 Patch 2). For the latest Custom Firmware, please contact the WAGO support.
Mitigation
CVE-2024-41967, CVE-2024-41968, CVE-2024-41969 and CVE-2024-41974: Remove the linux user "user" from the linux group “wbmuser” by accessing the controller shell as root and executing the command “gpasswd -d user wbmuser”. You should check the result with the command “groups user”, which should output “wbm user”.
CVE-2024-41971, CVE-2024-41972 and CVE-2024-41973: Access to the CODESYS Runtime should be completely restricted, ensuring that no unauthorized interaction or interference with the runtime environment is possible.
CERT@VDE coordinated with WAGO GmbH & Co. KG
Reported by Diego Giubertoni by Nozomi Networks