{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "tracking": { "generator": { "date": "2024-10-14T08:35:23.962Z", "engine": { "version": "2.5.12", "name": "Secvisogram" } }, "id": "VDE-2020-028", "version": "3", "status": "final", "aliases": [ "VDE-2020-028" ], "revision_history": [ { "number": "1", "summary": "initial revision", "date": "2020-09-30T11:08:00.000Z" }, { "date": "2025-04-10T13:00:00.000Z", "number": "2", "summary": "Fixed csaf reference URL" }, { "number": "3", "summary": "Fix: added distribution", "date": "2025-05-14T13:00:14.000Z" } ], "current_release_date": "2025-05-14T13:00:14.000Z", "initial_release_date": "2020-09-30T11:08:00.000Z" }, "lang": "en-GB", "title": "WAGO: Authentication Bypass Vulnerability in WAGO 750-36X and WAGO 750-8XX Version <= FW03", "acknowledgments": [ { "organization": "CERTVDE", "urls": [ "https://certvde.com" ], "summary": "coordination" } ], "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "notes": [ { "category": "summary", "title": "Summary", "text": "The Web-Based Management (WBM) of WAGOs programmable logic controller (PLC) is typically used for administration, commissioning and updates.\nWith special crafted requests it is possible to change some special parameters without authentication." }, { "category": "description", "title": "Impact", "text": "This vulnerability allows an attacker who has access to the WBM and knowledge about the directory structure from the WBM to change the parameter setting of the devices by sending specifically constructed requests without authentication.\nThis can lead to malfunction of the application after reboot." }, { "category": "description", "title": "Mitigation", "text": "* Restrict network access to the device.\n* Do not directly connect the device to the internet.\n* Disable unused TCP/UDP ports.\n* Disable web-based management ports 80/443 after the configuration phase" } ], "publisher": { "category": "vendor", "contact_details": "psirt@wago.com", "name": "WAGO GmbH & Co. KG", "namespace": "https://www.wago.com/psirt" }, "references": [ { "category": "external", "summary": "WAGO GmbH & Co. KG", "url": "https://www.wago.com/psirt" }, { "category": "external", "summary": "CERT@VDE Security Advisories", "url": "https://certvde.com/en/advisories/vendor/wago/" }, { "category": "self", "url": "https://certvde.com/en/advisories/VDE-2020-028/", "summary": "VDE-2020-028: WAGO: Authentication Bypass Vulnerability in WAGO 750-36X and WAGO 750-8XX Version <= FW03 - HTML" }, { "summary": "VDE-2020-028: WAGO: Authentication Bypass Vulnerability in WAGO 750-36X and WAGO 750-8XX Version <= FW03 - CSAF", "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2020/vde-2020-028.json", "category": "self" } ] }, "product_tree": { "branches": [ { "category": "vendor", "name": "WAGO GmbH & Co. KG", "branches": [ { "category": "product_family", "name": "Hardware", "branches": [ { "category": "product_name", "name": "750-362", "product": { "name": "750-362", "product_id": "CSAFPID-11001", "product_identification_helper": { "model_numbers": [ "750-362" ] } } }, { "category": "product_name", "name": "750-363", "product": { "name": "750-363", "product_id": "CSAFPID-11002", "product_identification_helper": { "model_numbers": [ "750-363" ] } } }, { "category": "product_name", "name": "750-823", "product": { "name": "750-823", "product_id": "CSAFPID-11003", "product_identification_helper": { "model_numbers": [ "750-823" ] } } }, { "category": "product_name", "name": "750-832/xxx-xxx", "product": { "name": "750-832/xxx-xxx", "product_id": "CSAFPID-11004", "product_identification_helper": { "model_numbers": [ "750-832/xxx-xxx" ] } } }, { "category": "product_name", "name": "750-862", "product": { "name": "750-862", "product_id": "CSAFPID-11005", "product_identification_helper": { "model_numbers": [ "750-862" ] } } }, { "category": "product_name", "name": "750-890/0xx-xxx", "product": { "name": "750-890/0xx-xxx", "product_id": "CSAFPID-11006", "product_identification_helper": { "model_numbers": [ "750-890/0xx-xxx" ] } } }, { "category": "product_name", "name": "750-891", "product": { "name": "750-891", "product_id": "CSAFPID-11007", "product_identification_helper": { "model_numbers": [ "750-891" ] } } } ] }, { "category": "product_family", "name": "Firmware", "branches": [ { "category": "product_version_range", "name": "<=FW03", "product": { "name": "Firmware <=FW03", "product_id": "CSAFPID-21001" } }, { "category": "product_version_range", "name": ">FW03", "product": { "name": "Firmware >FW03", "product_id": "CSAFPID-22001" } } ] } ] } ], "relationships": [ { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11001", "full_product_name": { "name": "Firmware <=FW03 installed on 750-362", "product_id": "CSAFPID-31001" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11001", "full_product_name": { "name": "Firmware >FW03 installed on 750-362", "product_id": "CSAFPID-32001" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11002", "full_product_name": { "name": "Firmware <=FW03 installed on 750-363", "product_id": "CSAFPID-31002" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11002", "full_product_name": { "name": "Firmware >FW03 installed on 750-363", "product_id": "CSAFPID-32002" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11003", "full_product_name": { "name": "Firmware <=FW03 installed on 750-823", "product_id": "CSAFPID-31003" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11003", "full_product_name": { "name": "Firmware >FW03 installed on 750-823", "product_id": "CSAFPID-32003" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11004", "full_product_name": { "name": "Firmware <=FW03 installed on 750-832/xxx-xxx", "product_id": "CSAFPID-31004" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11004", "full_product_name": { "name": "Firmware >FW03 installed on 750-832/xxx-xxx", "product_id": "CSAFPID-32004" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11005", "full_product_name": { "name": "Firmware <=FW03 installed on 750-862", "product_id": "CSAFPID-31005" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11005", "full_product_name": { "name": "Firmware >FW03 installed on 750-862", "product_id": "CSAFPID-32005" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11006", "full_product_name": { "name": "Firmware <=FW03 installed on 750-890/0xx-xxx", "product_id": "CSAFPID-31006" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11006", "full_product_name": { "name": "Firmware >FW03 installed on 750-890/0xx-xxx", "product_id": "CSAFPID-32006" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11007", "full_product_name": { "name": "Firmware <=FW03 installed on 750-891", "product_id": "CSAFPID-31007" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11007", "full_product_name": { "name": "Firmware >FW03 installed on 750-891", "product_id": "CSAFPID-32007" } } ], "product_groups": [ { "group_id": "CSAFGID-0001", "summary": "Affected Products", "product_ids": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007" ] }, { "group_id": "CSAFGID-0002", "summary": "Fixed Products", "product_ids": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007" ] } ] }, "vulnerabilities": [ { "cve": "CVE-2020-12506", "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007" ], "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007" ] }, "scores": [ { "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007" ], "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL", "temporalScore": 9.1, "temporalSeverity": "CRITICAL", "environmentalScore": 9.1, "environmentalSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH" } } ], "notes": [ { "category": "description", "title": "Vulnerability Description", "text": "Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW03 allows an attacker to change the settings of the devices by sending specifically constructed requests without authentication This issue affects: WAGO 750-362 version FW03 and prior versions. WAGO 750-363 version FW03 and prior versions. WAGO 750-823 version FW03 and prior versions. WAGO 750-832/xxx-xxx version FW03 and prior versions. WAGO 750-862 version FW03 and prior versions. WAGO 750-891 version FW03 and prior versions. WAGO 750-890/xxx-xxx version FW03 and prior versions." } ], "remediations": [ { "group_ids": [ "CSAFGID-0001" ], "category": "mitigation", "details": "* Restrict network access to the device.\n* Do not directly connect the device to the internet.\n* Disable unused TCP/UDP ports.\n* Disable web-based management ports 80/443 after the configuration phase" }, { "group_ids": [ "CSAFGID-0001" ], "category": "vendor_fix", "details": "Update affected devices to version >FW03" } ], "cwe": { "id": "CWE-287", "name": "Improper Authentication" }, "title": "CVE-2020-12506" } ] }