{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "tracking": { "generator": { "date": "2024-09-18T09:38:05.053Z", "engine": { "version": "2.5.12", "name": "Secvisogram" } }, "id": "VDE-2020-044", "version": "4", "status": "final", "aliases": [ "VDE-2020-044" ], "revision_history": [ { "number": "1", "summary": "initial revision", "date": "2021-08-31T07:01:00.000Z" }, { "date": "2024-11-06T11:27:01.000Z", "number": "2", "summary": "Fix: correct certvde domain, fixed language setting, added self-reference" }, { "date": "2025-02-12T16:48:47.000Z", "number": "3", "summary": "Fix: corrected self-reference, fixed version" }, { "number": "4", "summary": "Fix: added distribution", "date": "2025-05-14T13:00:14.000Z" } ], "current_release_date": "2025-05-14T13:00:14.000Z", "initial_release_date": "2021-08-31T07:01:00.000Z" }, "lang": "en-GB", "title": "WAGO: Web-Based Management Authentication Vulnerability in WAGO 750-36X and WAGO 750-8XX", "acknowledgments": [ { "organization": "CERTVDE", "urls": [ "https://certvde.com" ], "summary": "coordination" } ], "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "notes": [ { "category": "summary", "title": "Summary", "text": "The Web-Based Management (WBM) of WAGOs programmable logic controller (PLC) is typically used for administration, commissioning and updates.\nWith special crafted requests it is possible to read and write some special parameters without authentication.\nThis vulnerability is different to advisory SAV-2020-014 / VDE-2020-028" }, { "category": "description", "title": "Impact", "text": "This vulnerability allows an attacker who has access to the WBM and knowledge about the directory structure of the WBM to read and/or write a settings-parameter of the devices by sending specifically constructed requests without authentication.\nThis can lead to malfunction of the application after reboot." }, { "category": "description", "title": "Mitigation", "text": "* Restrict network access to the device. \n * Do not directly connect the device to the internet.\n \n* Disable unused TCP/UDP ports.\n \n* Disable web-based management ports 80/443 after the configuration phase" }, { "category": "description", "title": "Remediation", "text": "Update the device to the latest FW version." } ], "publisher": { "category": "vendor", "contact_details": "psirt@wago.com", "name": "WAGO GmbH & Co. KG", "namespace": "https://www.wago.com/psirt" }, "references": [ { "category": "external", "summary": "WAGO GmbH & Co. KG", "url": "https://www.wago.com/psirt" }, { "category": "external", "summary": "CERT@VDE Security Advisories", "url": "https://certvde.com/en/advisories/vendor/wago/" }, { "category": "self", "url": "https://certvde.com/en/advisories/VDE-2020-044/", "summary": "VDE-2020-044: WAGO: Web-Based Management Authentication Vulnerability in WAGO 750-36X and WAGO 750-8XX - HTML" }, { "summary": "VDE-2020-044: WAGO: Web-Based Management Authentication Vulnerability in WAGO 750-36X and WAGO 750-8XX - CSAF", "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2021/vde-2020-044.json", "category": "self" } ] }, "product_tree": { "branches": [ { "category": "vendor", "name": "WAGO GmbH & Co. KG", "branches": [ { "category": "product_family", "name": "Hardware", "branches": [ { "category": "product_name", "name": "750-362", "product": { "name": "750-362", "product_id": "CSAFPID-11001", "product_identification_helper": { "model_numbers": [ "750-362" ] } } }, { "category": "product_name", "name": "750-363", "product": { "name": "750-363", "product_id": "CSAFPID-11002", "product_identification_helper": { "model_numbers": [ "750-363" ] } } }, { "category": "product_name", "name": "750-823", "product": { "name": "750-823", "product_id": "CSAFPID-11003", "product_identification_helper": { "model_numbers": [ "750-823" ] } } }, { "category": "product_name", "name": "750-832/xxx-xxx", "product": { "name": "750-832/xxx-xxx", "product_id": "CSAFPID-11004", "product_identification_helper": { "model_numbers": [ "750-832/xxx-xxx" ] } } }, { "category": "product_name", "name": "750-862", "product": { "name": "750-862", "product_id": "CSAFPID-11005", "product_identification_helper": { "model_numbers": [ "750-862" ] } } }, { "category": "product_name", "name": "750-890/xxx-xxx", "product": { "name": "750-890/xxx-xxx", "product_id": "CSAFPID-11006", "product_identification_helper": { "model_numbers": [ "750-890/xxx-xxx" ] } } }, { "category": "product_name", "name": "750-891", "product": { "name": "750-891", "product_id": "CSAFPID-11007", "product_identification_helper": { "model_numbers": [ "750-891" ] } } }, { "category": "product_name", "name": "750-893", "product": { "name": "750-893", "product_id": "CSAFPID-11008", "product_identification_helper": { "model_numbers": [ "750-893" ] } } } ] }, { "category": "product_family", "name": "Firmware", "branches": [ { "category": "product_version_range", "name": "<=FW07", "product": { "name": "Firmware <=FW07", "product_id": "CSAFPID-21001" } }, { "category": "product_version", "name": "FW08", "product": { "name": "Firmware FW08", "product_id": "CSAFPID-22001" } } ] } ] } ], "relationships": [ { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11001", "full_product_name": { "name": "Firmware <=FW07 installed on 750-362", "product_id": "CSAFPID-31001" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11001", "full_product_name": { "name": "Firmware FW08 installed on 750-362", "product_id": "CSAFPID-32001" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11002", "full_product_name": { "name": "Firmware <=FW07 installed on 750-363", "product_id": "CSAFPID-31002" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11002", "full_product_name": { "name": "Firmware FW08 installed on 750-363", "product_id": "CSAFPID-32002" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11003", "full_product_name": { "name": "Firmware <=FW07 installed on 750-823", "product_id": "CSAFPID-31003" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11003", "full_product_name": { "name": "Firmware FW08 installed on 750-823", "product_id": "CSAFPID-32003" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11004", "full_product_name": { "name": "Firmware <=FW07 installed on 750-832/xxx-xxx", "product_id": "CSAFPID-31004" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11004", "full_product_name": { "name": "Firmware FW08 installed on 750-832/xxx-xxx", "product_id": "CSAFPID-32004" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11005", "full_product_name": { "name": "Firmware <=FW07 installed on 750-862", "product_id": "CSAFPID-31005" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11005", "full_product_name": { "name": "Firmware FW08 installed on 750-862", "product_id": "CSAFPID-32005" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11006", "full_product_name": { "name": "Firmware <=FW07 installed on 750-890/xxx-xxx", "product_id": "CSAFPID-31006" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11006", "full_product_name": { "name": "Firmware FW08 installed on 750-890/xxx-xxx", "product_id": "CSAFPID-32006" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11007", "full_product_name": { "name": "Firmware <=FW07 installed on 750-891", "product_id": "CSAFPID-31007" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11007", "full_product_name": { "name": "Firmware FW08 installed on 750-891", "product_id": "CSAFPID-32007" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11008", "full_product_name": { "name": "Firmware <=FW07 installed on 750-893", "product_id": "CSAFPID-31008" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11008", "full_product_name": { "name": "Firmware FW08 installed on 750-893", "product_id": "CSAFPID-32008" } } ], "product_groups": [ { "group_id": "CSAFGID-0001", "summary": "Affected Products", "product_ids": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008" ] }, { "group_id": "CSAFGID-0002", "summary": "Fixed Products", "product_ids": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008" ] } ] }, "vulnerabilities": [ { "cve": "CVE-2021-34578", "title": "CVE-2021-34578", "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008" ], "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008" ] }, "scores": [ { "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008" ], "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "temporalScore": 8.1, "temporalSeverity": "HIGH", "environmentalScore": 8.1, "environmentalSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH" } } ], "remediations": [ { "category": "mitigation", "details": "* Restrict network access to the device.\n* Do not directly connect the device to the internet.\n* Disable unused TCP/UDP ports.\n* Disable web-based management ports 80/443 after the configuration phase", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "Update the device to the latest FW version.", "group_ids": [ "CSAFGID-0001" ] } ], "cwe": { "id": "CWE-287", "name": "Improper Authentication" }, "notes": [ { "category": "description", "title": "Vulnerability Description", "text": "This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically constructed requests without authentication on multiple WAGO PLCs in firmware versions up to FW07." } ] } ] }