{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "tracking": { "generator": { "date": "2025-02-26T16:19:42.056Z", "engine": { "version": "2.5.19", "name": "Secvisogram" } }, "current_release_date": "2025-05-14T12:28:19.000Z", "id": "VDE-2020-027", "initial_release_date": "2020-09-30T11:06:00.000Z", "status": "final", "version": "2", "revision_history": [ { "date": "2020-09-30T11:06:00.000Z", "number": "1", "summary": "Initial revision." }, { "number": "2", "summary": "Fix: removed ia, firmware category, added distribution", "date": "2025-05-14T12:28:19.000Z" } ], "aliases": [ "VDE-2020-027" ] }, "acknowledgments": [ { "summary": "reported", "organization": "Maxim Rupp" }, { "summary": "coordination", "organization": "CERT@VDE" } ], "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "title": "WAGO: Vulnerability in web-based authentication in WAGO 750-8XX Version <= FW07", "notes": [ { "category": "summary", "title": "Summary", "text": "The Web-Based Management (WBM) of WAGOs programmable logic controller (PLC) is typically used for administration, commissioning and updates.\nWith special crafted requests it is possible to change some special parameters without authentication." }, { "category": "description", "text": "This vulnerability allows an attacker who has access to the WBM to prevent the loading of the runtime-application after restart of the device by sending specifically constructed requests without authentication.", "title": "Impact" }, { "category": "description", "title": "Solution", "text": "Upgrade affected devices to the latest standard firmware.\n| Product | Fixed Versions |\n|-------------------|----------------|\n| 750-852 | > FW07 |\n| 750-880/xxx-xxx | > FW07 |\n| 750-881 | > FW07 |\n| 750-831/xxx-xxx | > FW07 |\n| 750-882 | > FW07 |\n| 750-885/xxx-xxx | > FW07 |\n| 750-889 | > FW07 |\n" }, { "category": "description", "title": "Mitigation", "text": "Restrict network access to the device.\nDo not directly connect the device to the internet.\nDisable unused TCP/UDP ports.\nDisable web-based management ports 80/443 after the configuration phase" } ], "publisher": { "name": "WAGO GmbH & Co. KG", "namespace": "https://www.wago.com/psirt", "contact_details": "psirt@wago.com", "category": "vendor" }, "references": [ { "summary": "VDE-2020-027: WAGO: Vulnerability in web-based authentication in WAGO 750-8XX Version <= FW07 - HTML", "category": "self", "url": "https://certvde.com/de/advisories/VDE-2020-027/" }, { "summary": "CERT@VDE Security Advisories for WAGO GmbH & Co. KG", "category": "external", "url": "https://certvde.com/en/advisories/vendor/wago" }, { "summary": "VDE-2020-027: WAGO: Vulnerability in web-based authentication in WAGO 750-8XX Version <= FW07 - CSAF", "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2020/vde-2020-027.json", "category": "self" } ] }, "product_tree": { "branches": [ { "category": "vendor", "name": "WAGO", "branches": [ { "category": "product_family", "name": "Firmware", "branches": [ { "name": "<=FW07", "category": "product_version_range", "product": { "name": "Firmware <=FW07", "product_id": "CSAFPID-21001" } }, { "name": "FW08", "category": "product_version", "product": { "name": "Firmware FW08", "product_id": "CSAFPID-22001" } } ] }, { "name": "Hardware", "category": "product_family", "branches": [ { "name": "BACnet/IP Controller", "branches": [ { "name": "750-831/xxx-xxx", "category": "product_name", "product": { "name": "BACnet/IP Controller 750-831/xxx-xxx", "product_id": "CSAFPID-11001", "product_identification_helper": { "model_numbers": [ "750-831/xxx-xxx" ] } } }, { "name": "750-852", "category": "product_name", "product": { "name": "BACnet/IP Controller 750-852", "product_id": "CSAFPID-11002", "product_identification_helper": { "model_numbers": [ "750-852" ] } } }, { "name": "750-880/xxx-xxx", "category": "product_name", "product": { "name": "BACnet/IP Controller 750-880/xxx-xxx", "product_id": "CSAFPID-11003", "product_identification_helper": { "model_numbers": [ "750-880/xxx-xxx" ] } } }, { "name": "750-881", "category": "product_name", "product": { "name": "BACnet/IP Controller 750-881", "product_id": "CSAFPID-11004", "product_identification_helper": { "model_numbers": [ "750-881" ] } } }, { "name": "750-882", "category": "product_name", "product": { "name": "BACnet/IP Controller 750-882", "product_id": "CSAFPID-11005", "product_identification_helper": { "model_numbers": [ "750-882" ] } } }, { "name": "750-885/xxx-xxx", "category": "product_name", "product": { "name": "Controller 750-885/xxx-xxx", "product_id": "CSAFPID-11006", "product_identification_helper": { "model_numbers": [ "750-885/xxx-xxx" ] } } }, { "name": "750-889", "category": "product_name", "product": { "name": "BACnet/IP Controller 750-889", "product_id": "CSAFPID-11007", "product_identification_helper": { "model_numbers": [ "750-889" ] } } } ], "category": "product_name" } ] } ] } ], "relationships": [ { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11001", "full_product_name": { "name": "Firmware <=FW07 installed on BACnet/IP Controller 750-831/xxx-xxx", "product_id": "CSAFPID-31001" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11002", "full_product_name": { "name": "Firmware <=FW07 installed on BACnet/IP Controller 750-852", "product_id": "CSAFPID-31002" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11003", "full_product_name": { "name": "Firmware <=FW07 installed on BACnet/IP Controller 750-880/xxx-xxx", "product_id": "CSAFPID-31003" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11004", "full_product_name": { "name": "Firmware <=FW07 installed on BACnet/IP Controller 750-881", "product_id": "CSAFPID-31004" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11005", "full_product_name": { "name": "Firmware <=FW07 installed on BACnet/IP Controller 750-882", "product_id": "CSAFPID-31005" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11006", "full_product_name": { "name": "Firmware <=FW07 installed on Controller 750-885/xxx-xxx", "product_id": "CSAFPID-31006" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11007", "full_product_name": { "name": "Firmware <=FW07 installed on BACnet/IP Controller 750-889", "product_id": "CSAFPID-31007" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11001", "full_product_name": { "name": "Firmware FW08 installed on BACnet/IP Controller 750-831/xxx-xxx", "product_id": "CSAFPID-32001" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11002", "full_product_name": { "name": "Firmware FW08 installed on BACnet/IP Controller 750-852", "product_id": "CSAFPID-32002" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11003", "full_product_name": { "name": "Firmware FW08 installed on BACnet/IP Controller 750-880/xxx-xxx", "product_id": "CSAFPID-32003" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11004", "full_product_name": { "name": "Firmware FW08 installed on BACnet/IP Controller 750-881", "product_id": "CSAFPID-32004" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11005", "full_product_name": { "name": "Firmware FW08 installed on BACnet/IP Controller 750-882", "product_id": "CSAFPID-32005" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11006", "full_product_name": { "name": "Firmware FW08 installed on Controller 750-885/xxx-xxx", "product_id": "CSAFPID-32006" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11007", "full_product_name": { "name": "Firmware FW08 installed on BACnet/IP Controller 750-889", "product_id": "CSAFPID-32007" } } ], "product_groups": [ { "group_id": "CSAFGID-0001", "summary": "Affected products.", "product_ids": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007" ] }, { "group_id": "CSAFGID-0002", "summary": "Fixed products.", "product_ids": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007" ] } ] }, "vulnerabilities": [ { "cve": "CVE-2020-12505", "title": "CVE-2020-12505", "cwe": { "id": "CWE-287", "name": "Improper Authentication" }, "notes": [ { "title": "Vulnerability Description", "text": "Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW07 allows an attacker to change some special parameters without authentication. This issue affects: WAGO 750-852 version FW07 and prior versions. WAGO 750-880/xxx-xxx version FW07 and prior versions. WAGO 750-881 version FW07 and prior versions. WAGO 750-831/xxx-xxx version FW07 and prior versions. WAGO 750-882 version FW07 and prior versions. WAGO 750-885/xxx-xxx version FW07 and prior versions. WAGO 750-889 version FW07 and prior versions.", "category": "description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007" ], "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007" ] }, "remediations": [ { "category": "mitigation", "details": "Mitigation\n\nRestrict network access to the device.\nDo not directly connect the device to the internet.\nDisable unused TCP/UDP ports.\nDisable web-based management ports 80/443 after the configuration phase", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "Upgrade affected devices to the latest standard firmware.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "baseScore": 8.2, "baseSeverity": "HIGH", "temporalScore": 8.2, "temporalSeverity": "HIGH", "environmentalScore": 8.2, "environmentalSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "HIGH" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007" ] } ] } ] }