WAGO: Web-Based Management Authentication Vulnerability in WAGO 750-36X and WAGO 750-8XX Versions <= FW07

VDE-2020-044 (2021-08-31 09:00 UTC+0200)

CVE Identifier

CVE-2021-34578

Affected Vendors

WAGO

Affected Products

Product Affected Versions
750-362 <= FW07
750-363 <= FW07
750-823 <= FW07
750-832/xxx-xxx <= FW07
750-862 <= FW07
750-891 <= FW07
750-890/xxx-xxx <= FW07
750-893 <= FW07

Vulnerability Type

Improper Authentication and Acess Control (CWE-287)

Summary

The Web-Based Management (WBM) of WAGOs programmable logic controller (PLC) is typically used for administration, commissioning and updates.
With special crafted requests it is possible to read and write some special parameters without authentication.
This vulnerability is different to advisory SAV-2020-014 / VDE-2020-028.

Impact

This vulnerability allows an attacker who has access to the WBM and knowledge about the directory structure of the WBM to read and/or write a settings-parameter of the devices by sending specifically constructed requests without authentication.
This can lead to malfunction of the application after reboot.

Solution

Update the device to the latest FW version.

Mitigation

  • Restrict network access to the device.
  • Do not directly connect the device to the internet.
  • Disable unused TCP/UDP ports.
  • Disable web-based management ports 80/443 after the configuration phase

Reported by

Maxim Rupp (https://rupp.it) reported this vulnerability to WAGO.
CERT@VDE coordinated.