# Recent vulnerabilities from WAGO GmbH & Co. KG ## [vde-2023-045](https://vulnerability.circl.lu/vuln/vde-2023-045) ```json { "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] }, { "organization": "White Oak Security", "names": [ "Brett Dewall" ], "summary": "reporting" } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "An attacker with privileges can enumerate projects and usernames through an iterative process, by making a request to a specific endpoint.", "title": "Summary" }, { "category": "description", "text": "The vulnerability might result in disclosure of sensitive information.", "title": "Impact" }, { "category": "description", "text": "A patch for the WAGO Smart Designer will be available with version 2.34.", "title": "Remediation" } ], "publisher": { "contact_details": "psirt@wago.com", "name": "WAGO GmbH & Co. KG", "namespace": "https://www.wago.com/psirt", "category": "vendor" }, "references": [ { "category": "self", "summary": "VDE-2023-045: Wago: Vulnerability in Smart Designer Web-Application - HTML", "url": "https://certvde.com/en/advisories/VDE-2023-045/" }, { "category": "self", "summary": "VDE-2023-045: Wago: Vulnerability in Smart Designer Web-Application - CSAF", "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2023/vde-2023-045.json" }, { "category": "external", "summary": "Vendor PSIRT", "url": "https://www.wago.com/psirt" }, { "category": "external", "summary": "CERT@VDE Security Advisories for WAGO GmbH & Co. KG", "url": "https://certvde.com/en/advisories/vendor/wago/" } ], "title": "Wago: Vulnerability in Smart Designer Web-Application", "tracking": { "aliases": [ "VDE-2023-045" ], "current_release_date": "2023-12-05T07:00:00.000Z", "generator": { "date": "2025-04-30T14:13:55.503Z", "engine": { "name": "Secvisogram", "version": "2.5.24" } }, "id": "VDE-2023-045", "initial_release_date": "2023-12-05T07:00:00.000Z", "revision_history": [ { "date": "2023-12-05T07:00:00.000Z", "number": "1", "summary": "Initial revision." } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "name": "Vendor", "category": "vendor", "branches": [ { "name": "Software", "category": "product_family", "branches": [ { "name": "Smart Designer", "category": "product_name", "branches": [ { "name": "<=2.33.1", "category": "product_version_range", "product": { "name": "Smart Designer <=2.33.1", "product_id": "CSAFPID-51001" } }, { "name": "2.34", "category": "product_version", "product": { "name": "Smart Designer 2.34", "product_id": "CSAFPID-52001" } } ] } ] } ] } ] }, "vulnerabilities": [ { "cve": "CVE-2023-5872", "title": "CVE-2023-5872", "cwe": { "id": "CWE-203", "name": "Observable Discrepancy" }, "notes": [ { "text": "In Wago Smart Designer in versions up to 2.33.1 a low privileged remote attacker may enumerate projects and usernames through iterative requests to an specific endpoint.", "category": "description", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-52001" ], "known_affected": [ "CSAFPID-51001" ] }, "remediations": [ { "category": "vendor_fix", "details": "A patch for the WAGO Smart Designer will be available with version 2.34.", "product_ids": [ "CSAFPID-51001" ] } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "temporalScore": 4.3, "temporalSeverity": "MEDIUM", "environmentalScore": 4.3, "environmentalSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE" }, "products": [ "CSAFPID-51001" ] } ] } ] } ``` ## [vde-2023-044](https://vulnerability.circl.lu/vuln/vde-2023-044) ```json { "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] }, { "organization": "Sofia Pisani", "summary": "reporting" } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "The Library WagoAppRTU which is part of the Wago Telecontrol Configurator is prone to improper input validation. By sending specifically crafted MMS packets an attacker can trigger a denial-of-service condition.", "title": "Summary" }, { "category": "description", "text": "Affected devices will stop working after receiving specifically crafted packets until restart.", "title": "Impact" }, { "category": "description", "text": "Restrict network access to the device.\nDo not directly connect the device to the internet.", "title": "Mitigation" }, { "category": "description", "text": "A fix for WAGO Telecontrol Configurator is contained within the IEC-library WagoAppRTU 1.4.6.0 and available via Wago support. (A new release is planned for the end of the year.)", "title": "Remediation" } ], "publisher": { "contact_details": "psirt@wago.com", "name": "WAGO GmbH & Co. KG", "namespace": "https://www.wago.com/psirt", "category": "vendor" }, "references": [ { "category": "self", "summary": "VDE-2023-044: Wago: Vulnerabilities in IEC61850 Server / Telecontrol - HTML", "url": "https://certvde.com/en/advisories/VDE-2023-044/" }, { "category": "self", "summary": "VDE-2023-044: Wago: Vulnerabilities in IEC61850 Server / Telecontrol - CSAF", "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2023/vde-2023-044.json" }, { "category": "external", "summary": "WAGO PSIRT", "url": "https://www.wago.com/psirt" }, { "category": "external", "summary": "CERT@VDE Security Advisories for WAGO GmbH & Co. KG", "url": "https://certvde.com/en/advisories/vendor/wago/" } ], "title": "Wago: Vulnerabilities in IEC61850 Server / Telecontrol", "tracking": { "aliases": [ "VDE-2023-044" ], "current_release_date": "2023-12-05T07:00:00.000Z", "generator": { "date": "2025-05-05T11:29:56.760Z", "engine": { "name": "Secvisogram", "version": "2.5.24" } }, "id": "VDE-2023-044", "initial_release_date": "2023-12-05T07:00:00.000Z", "revision_history": [ { "date": "2023-12-05T07:00:00.000Z", "number": "1", "summary": "Initial revision." } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "name": "Wago", "category": "vendor", "branches": [ { "name": "Software", "category": "product_family", "branches": [ { "name": "Telecontrol Configurator", "category": "product_name", "branches": [ { "name": "vers:all/*", "category": "product_version_range", "product": { "name": "Telecontrol Configurator vers:all/*", "product_id": "CSAFPID-51001" } } ] }, { "name": "WagoAppRTU", "category": "product_name", "branches": [ { "name": "<1.4.6.0", "category": "product_version_range", "product": { "name": "WagoAppRTU < 1.4.6.0", "product_id": "CSAFPID-51002" } }, { "name": "1.4.6.0", "category": "product_version", "product": { "name": "WagoAppRTU 1.4.6.0", "product_id": "CSAFPID-52001" } } ] } ] } ] } ], "product_groups": [ { "group_id": "CSAFGID-0001", "product_ids": [ "CSAFPID-51001", "CSAFPID-51002" ], "summary": "Affected products." } ] }, "vulnerabilities": [ { "cve": "CVE-2023-5188", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "description", "text": "The MMS Interpreter of WagoAppRTU in versions below 1.4.6.0 which is used by the WAGO Telecontrol Configurator is vulnerable to malformed packets. An remote unauthenticated attacker could send specifically crafted packets that lead to a denial-of-service condition until restart of the affected device.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-52001" ], "known_affected": [ "CSAFPID-51001", "CSAFPID-51002" ] }, "remediations": [ { "category": "mitigation", "details": "Restrict network access to the device.\nDo not directly connect the device to the internet.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "A fix for WAGO Telecontrol Configurator is contained within the IEC-library WagoAppRTU 1.4.6.0 and available via Wago support. (A new release is planned for the end of the year.)", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 7.5, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-51001", "CSAFPID-51002" ] } ], "title": "CVE-2023-5188" } ] } ``` ## [vde-2023-037](https://vulnerability.circl.lu/vuln/vde-2023-037) ```json { "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] }, { "organization": "GAI NetConsult", "summary": "reporting" }, { "organization": "INTILION AG", "summary": "reporting" } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "Affected products are vulnerable to remote code execution via command injection in the web-based management by an attacker.", "title": "Summary" }, { "category": "description", "text": "An unprivileged attacker can fully compromise the system and access all files.", "title": "Impact" }, { "category": "description", "text": "Restrict network access to the device.\nDo not directly connect the device to the internet.", "title": "Mitigation" }, { "category": "description", "text": "WAGO recommends all affected users of products 0852-0602, 0852-0603 to update to firmware version 1.0.6.S0 and all affected users of 852-1605 to update to firmware version 1.2.5.S0.", "title": "Remediation" } ], "publisher": { "contact_details": "psirt@wago.com", "name": "WAGO GmbH & Co. KG", "namespace": "https://www.wago.com/psirt", "category": "vendor" }, "references": [ { "category": "self", "summary": "VDE-2023-037: WAGO: Remote Code execution vulnerability in managed Switches - HTML", "url": "https://certvde.com/en/advisories/VDE-2023-037/" }, { "category": "self", "summary": "VDE-2023-037: WAGO: Remote Code execution vulnerability in managed Switches - CSAF", "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2023/vde-2023-037.json" }, { "category": "external", "summary": "WAGO PSIRT", "url": "https://www.wago.com/psirt" }, { "category": "external", "summary": "CERT@VDE Security Advisories for WAGO GmbH & Co. KG", "url": "https://certvde.com/en/advisories/vendor/wago/" } ], "title": "WAGO: Remote Code execution vulnerability in managed Switches", "tracking": { "aliases": [ "VDE-2023-037" ], "current_release_date": "2023-11-21T07:00:00.000Z", "generator": { "date": "2025-05-05T12:00:14.718Z", "engine": { "name": "Secvisogram", "version": "2.5.24" } }, "id": "VDE-2023-037", "initial_release_date": "2023-11-21T07:00:00.000Z", "revision_history": [ { "date": "2023-11-21T07:00:00.000Z", "number": "1", "summary": "Initial revision." } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "name": "WAGO", "category": "vendor", "branches": [ { "name": "Hardware", "category": "product_family", "branches": [ { "name": "Industrial Managed Switch", "category": "product_name", "product": { "name": "Industrial Managed Switch", "product_id": "CSAFPID-11001", "product_identification_helper": { "model_numbers": [ "0852-1605", "0852-0603", "0852-0602" ] } } } ] }, { "name": "Firmware", "category": "product_family", "branches": [ { "name": "<1.2.5.S0", "category": "product_version_range", "product": { "name": "Firmware < 1.2.5.S0", "product_id": "CSAFPID-21001" } }, { "name": "<1.0.6.S0", "category": "product_version_range", "product": { "name": "Firmware < 1.0.6.S0", "product_id": "CSAFPID-21002" } }, { "name": "1.2.5.S0", "category": "product_version", "product": { "name": "Firmware 1.2.5.S0", "product_id": "CSAFPID-22001" } }, { "name": "1.0.6.S0", "category": "product_version", "product": { "name": "Firmware 1.0.6.S0", "product_id": "CSAFPID-22002" } } ] } ] } ], "product_groups": [ { "group_id": "CSAFGID-0001", "product_ids": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ], "summary": "Affected products." }, { "group_id": "CSAFGID-0002", "product_ids": [ "CSAFPID-32001", "CSAFPID-32002" ], "summary": "Fixed products." } ], "relationships": [ { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11001", "category": "installed_on", "full_product_name": { "name": "Firmware < 1.2.5.S0 installed on Industrial Managed Switch", "product_id": "CSAFPID-31001" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11001", "category": "installed_on", "full_product_name": { "name": "Firmware < 1.0.6.S0 installed on Industrial Managed Switch", "product_id": "CSAFPID-31002" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11001", "category": "installed_on", "full_product_name": { "name": "Firmware < 1.0.6.S0 installed on Industrial Managed Switch", "product_id": "CSAFPID-31003" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11001", "category": "installed_on", "full_product_name": { "name": "Firmware 1.2.5.S0 installed on Industrial Managed Switch", "product_id": "CSAFPID-32001" } }, { "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11001", "category": "installed_on", "full_product_name": { "name": "Firmware 1.0.6.S0 installed on Industrial Managed Switch", "product_id": "CSAFPID-32002" } } ] }, "vulnerabilities": [ { "cve": "CVE-2023-4149", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "category": "description", "text": "A vulnerability in the web-based management allows an unauthenticated remote attacker to inject arbitrary system commands and gain full system control. Those commands are executed with root privileges. The vulnerability is located in the user request handling of the web-based management.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] }, "remediations": [ { "category": "mitigation", "details": "Restrict network access to the device.\nDo not directly connect the device to the internet.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "WAGO recommends all affected users of products 0852-0602, 0852-0603 to update to firmware version 1.0.6.S0 and all affected users of 852-1605 to update to firmware version 1.2.5.S0.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] } ], "title": "CVE-2023-4149" } ] } ``` ## [vde-2023-015](https://vulnerability.circl.lu/vuln/vde-2023-015) ```json { "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] }, { "organization": "Secura", "summary": "reporting", "names": [ "Panagiotis Bellonias" ] } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "There is a misconfiguration of access rights to a configuration tool of the web-based-management for a specific user, which allows to reset passwords of other users (except root). This allows an authenticated attacker to elevate his privileges.", "title": "Summary" }, { "category": "description", "text": "An authenticated attacker can get further privileges allowing the attacker to change configuration and perform actions beyond the original user scope.", "title": "Impact" }, { "category": "description", "text": "Restrict network access to the device.\nDo not directly connect the device to the internet.", "title": "Mitigation" }, { "category": "description", "text": "Wago recommends all affected users to update to the firmware version listed below:\n\n### Series WAGO PFC100/PFC200 and WAGO Compact Controller CC100\n\n| Article Number | Fixed in Firmware Version |\n|-----------------------|----------------------------------|\n| 750-811x/xxx-xxx | FW22 Patch 2 |\n| 750-821x/xxx-xxx | FW26 |\n| 750-820x/xxx-xxx | FW22 Patch 2 |\n| 751-9301 | FW26 |\n\n### Series WAGO Touch Panel 600 and WAGO Edge Controller\n\n| Article Number | Fixed in Firmware Version |\n|-----------------------|----------------------------------|\n| 762-4xxx | FW26 |\n| 762-5xxx | FW26 |\n| 762-6xxx | FW26 |\n| 752-8303/8000-002 | FW26 |\n\nFW22 Patch 2 will be available in Q1 2024.", "title": "Remediation" } ], "publisher": { "contact_details": "psirt@wago.com", "name": "WAGO GmbH & Co. KG", "namespace": "https://www.wago.com/psirt", "category": "vendor" }, "references": [ { "category": "self", "summary": "VDE-2023-015: WAGO: Improper privilege management in web-based management - HTML", "url": "https://certvde.com/en/advisories/VDE-2023-015/" }, { "category": "self", "summary": "VDE-2023-015: WAGO: Improper privilege management in web-based management - CSAF", "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2023/vde-2023-015.json" }, { "category": "external", "summary": "WAGO PSIRT", "url": "https://www.wago.com/psirt" }, { "category": "external", "summary": "CERT@VDE Security Advisories for WAGO GmbH & Co. KG", "url": "https://certvde.com/en/advisories/vendor/wago/" } ], "title": "WAGO: Improper privilege management in web-based management", "tracking": { "aliases": [ "VDE-2023-015" ], "current_release_date": "2023-11-20T07:00:00.000Z", "generator": { "date": "2025-05-05T11:26:03.403Z", "engine": { "name": "Secvisogram", "version": "2.5.24" } }, "id": "VDE-2023-015", "initial_release_date": "2023-11-20T07:00:00.000Z", "revision_history": [ { "date": "2023-11-20T07:00:00.000Z", "number": "1", "summary": "Initial revision." } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "name": "WAGO", "category": "vendor", "branches": [ { "name": "Hardware", "category": "product_family", "branches": [ { "name": "Compact Controller 100", "category": "product_name", "product": { "name": "Compact Controller 100", "product_id": "CSAFPID-11001", "product_identification_helper": { "model_numbers": [ "751-9301/xxx-xxx" ] } } }, { "name": "Edge Controller", "category": "product_name", "product": { "name": "Edge Controller", "product_id": "CSAFPID-11002", "product_identification_helper": { "model_numbers": [ "752-8303/8000-002" ] } } }, { "name": "PFC100", "category": "product_name", "product": { "name": "PFC100", "product_id": "CSAFPID-11003", "product_identification_helper": { "model_numbers": [ "750-810x/xxx-xxx" ] } } }, { "name": "PFC200", "category": "product_name", "product": { "name": "PFC200", "product_id": "CSAFPID-11004", "product_identification_helper": { "model_numbers": [ "750-820x/xxx-xxx", "750-821x/xxx-xxx" ] } } }, { "name": "Touch Panel 600 Advanced Line", "category": "product_name", "product": { "name": "Touch Panel 600 Advanced Line", "product_id": "CSAFPID-11005", "product_identification_helper": { "model_numbers": [ "762-5xxx" ] } } }, { "name": "Touch Panel 600 Marine Line", "category": "product_name", "product": { "name": "Touch Panel 600 Marine Line", "product_id": "CSAFPID-11006", "product_identification_helper": { "model_numbers": [ "762-6xxx" ] } } }, { "name": "Touch Panel 600 Standard Line", "category": "product_name", "product": { "name": "Touch Panel 600 Standard Line", "product_id": "CSAFPID-11007", "product_identification_helper": { "model_numbers": [ "762-4xxx" ] } } } ] }, { "name": "Firmware", "category": "product_family", "branches": [ { "name": "<=FW25", "category": "product_version_range", "product": { "name": "Firmware <= FW25", "product_id": "CSAFPID-21001" } }, { "name": "<=FW22 Patch1", "category": "product_version_range", "product": { "name": "Firmware <= FW22 Patch1", "product_id": "CSAFPID-21002" } }, { "name": "FW26", "category": "product_version", "product": { "name": "Firmware FW26", "product_id": "CSAFPID-22001" } }, { "name": "FW22 Patch 2", "category": "product_version", "product": { "name": "Firmware FW22 Patch 2", "product_id": "CSAFPID-22002" } } ] } ] } ], "product_groups": [ { "group_id": "CSAFGID-0001", "product_ids": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ], "summary": "Affected products." }, { "group_id": "CSAFGID-0002", "product_ids": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003" ], "summary": "Fixed products." } ], "relationships": [ { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11001", "category": "installed_on", "full_product_name": { "name": "Firmware <= FW25 installed on Compact Controller 100", "product_id": "CSAFPID-31001" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11002", "category": "installed_on", "full_product_name": { "name": "Firmware <= FW25 installed on Edge Controller", "product_id": "CSAFPID-31002" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11003", "category": "installed_on", "full_product_name": { "name": "Firmware <= FW22 Patch1 installed on PFC100", "product_id": "CSAFPID-31003" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11004", "category": "installed_on", "full_product_name": { "name": "Firmware <= FW22 Patch1 installed on PFC200", "product_id": "CSAFPID-31004" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11005", "category": "installed_on", "full_product_name": { "name": "Firmware <= FW25 installed on PFC200", "product_id": "CSAFPID-31005" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11006", "category": "installed_on", "full_product_name": { "name": "Firmware <= FW25 installed on Touch Panel 600 Advanced Line", "product_id": "CSAFPID-31006" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11007", "category": "installed_on", "full_product_name": { "name": "Firmware <= FW25 installed on Touch Panel 600 Marine Line", "product_id": "CSAFPID-31007" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11001", "category": "installed_on", "full_product_name": { "name": "Firmware FW26 installed on Compact Controller 100", "product_id": "CSAFPID-32001" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11002", "category": "installed_on", "full_product_name": { "name": "Firmware FW26 installed on Edge Controller", "product_id": "CSAFPID-32002" } }, { "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11003", "category": "installed_on", "full_product_name": { "name": "Firmware FW22 Patch 2 installed on PFC100", "product_id": "CSAFPID-32003" } }, { "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11004", "category": "installed_on", "full_product_name": { "name": "Firmware FW22 Patch 2 installed on PFC200", "product_id": "CSAFPID-32004" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11005", "category": "installed_on", "full_product_name": { "name": "Firmware FW26 installed on PFC200", "product_id": "CSAFPID-32005" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11006", "category": "installed_on", "full_product_name": { "name": "Firmware FW26 installed on Touch Panel 600 Advanced Line", "product_id": "CSAFPID-32006" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11007", "category": "installed_on", "full_product_name": { "name": "Firmware FW26 installed on Touch Panel 600 Marine Line", "product_id": "CSAFPID-32007" } } ] }, "vulnerabilities": [ { "cve": "CVE-2023-3379", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "notes": [ { "category": "description", "text": "Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker to change the passwords of other non-admin users and thus to escalate non-root privileges.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007" ] }, "remediations": [ { "category": "mitigation", "details": "Restrict network access to the device.\nDo not directly connect the device to the internet.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "Wago recommends all affected users to update to the firmware version listed below:\n\n### Series WAGO PFC100/PFC200 and WAGO Compact Controller CC100\n\n| Article Number | Fixed in Firmware Version |\n|-----------------------|----------------------------------|\n| 750-811x/xxx-xxx | FW22 Patch 2 |\n| 750-821x/xxx-xxx | FW26 |\n| 750-820x/xxx-xxx | FW22 Patch 2 |\n| 751-9301 | FW26 |\n\n### Series WAGO Touch Panel 600 and WAGO Edge Controller\n\n| Article Number | Fixed in Firmware Version |\n|-----------------------|----------------------------------|\n| 762-4xxx | FW26 |\n| 762-5xxx | FW26 |\n| 762-6xxx | FW26 |\n| 752-8303/8000-002 | FW26 |\n\nFW22 Patch 2 will be available in Q1 2024.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "environmentalScore": 5.3, "environmentalSeverity": "MEDIUM", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 5.3, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007" ] } ], "title": "CVE-2023-3379" } ] } ``` ## [vde-2022-040](https://vulnerability.circl.lu/vuln/vde-2022-040) ```json { "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "UPDATE A: Solution has updated release datesUPDATE B: Solution has updated release datesThis Advisory is published with reference to:\n\nCODESYS Advisory 2022-11 (Security update for CODESYS Control V2)\nCODESYS Advisory 2022-12 (Security update for CODESYS V2 password transport)\nCODESYS Advisory 2022-13 (Security update for CODESYS Gateway V2)", "title": "Summary" }, { "category": "description", "text": "From vulnerabilities CVE-2022-1965, CVE-2022-32136, CVE-2022-32137, CVE-2022-32138, CVE-2022-32139, CVE-2022-32140, CVE-2022-32141, CVE-2022-32142, CVE-2022-32143 (CODESYS Advisory 2022-11):\nBy crafting special packets / requests a low skilled attacker can exploit the vulnerabilities. This can lead to denial-of-service conditions or deleting files.\n\nFrom vulnerabilities CVE-2022-31805, CVE-2022-31806 (CODESYS Advisory 2022-12):\nA low skilled attacker is able to gather insufficiently protected credentials having access to the communication between client and server.\n\nFrom vulnerabilities CVE-2022-31802, CVE-2022-31803, CVE-2022-31804 (CODESYS Advisory 2022-13):\nAn attacker with low skills is able to gather insufficiently protected credentials having local access or access to the online communication traffic", "title": "Impact" }, { "category": "description", "text": "For vulnerabilities CVE-2022-1965, CVE-2022-32136, CVE-2022-32137, CVE-2022-32138, CVE-2022-32139, CVE-2022-32140, CVE-2022-32141, CVE-2022-32142, CVE-2022-32143 (CODESYS Advisory 2022-11):\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n- Setting strong passwords\n- Use e!Runtime or CODESYS V3\n\nFor vulnerabilities CVE-2022-31805, CVE-2022-31806 (CODESYS Advisory 2022-12):\n\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n\n- Use encryption of online communication whenever possible, this protects password transmission.", "title": "Mitigation" }, { "text": "WAGO recommends that all affected users with WAGO I/O-PRO/CODESYS 2.3 PLCs update to the firmware and use the latest version of WAGO I/O-Pro as soon as it is available.\nUntil the updates are available, we recommend switching off the CODESYS IP port 2455 after commissioning or, if this not possible, use a strong admin password.\n\n### PFC200 Family\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-8202/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8203/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8204/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8206/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8207/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8208/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8210/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8211/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8212/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8213/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8214/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8216/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8217/xxx-xxx | UPDATE B: Available in Q1 2024 |\n\n### Ethernet Controller 4th Generation Family – UPDATE B\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-823 | UPDATE B: Available in Q1 2024 |\n| 750-332 | UPDATE B: Available in Q1 2024 |\n| 750-832/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-862 | UPDATE B: Available in Q1 2024 |\n| 750-890/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-891 | UPDATE B: Available in Q1 2024 |\n| 750-893 | UPDATE B: Available in Q1 2024 |\n\n### Ethernet Controller 3rd Generation Family – UPDATE B\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-331 | UPDATE B: Available in Q1 2024 |\n| 750-829 | UPDATE B: Available in Q1 2024 |\n| 750-831/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-852 | UPDATE B: Available in Q1 2024 |\n| 750-880/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-881 | UPDATE B: Available in Q1 2024 |\n| 750-882 | UPDATE B: Available in Q1 2024 |\n| 750-885/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-889 | UPDATE B: Available in Q1 2024 |\n\n### Engineering Software\n\n| Name | Firmware |\n|------------------|----------------------------------|\n| WAGO-I/O-PRO 32 | UPDATE B: Available in Q1 2024 |", "title": "Remediation", "category": "description" }, { "title": "General Mitigation Recommendations", "text": "- Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside\n\n- Use firewalls to protect and separate the control system network from other networks\n\n- Use VPN (Virtual Private Networks) tunnels if remote access is required\n\n- Activate and apply user management and password features\n\n- Use encrypted communication links\n\n- Limit the access to both development and control system by physical means, operating system features, etc.\n\n- Protect both development and control system by using up to date virus detecting solutions\n\nFor further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at\nwww.codesys.com/security/security-reports.html", "category": "general" } ], "publisher": { "contact_details": "psirt@wago.com", "name": "WAGO GmbH & Co. KG", "namespace": "https://www.wago.com/psirt", "category": "vendor" }, "references": [ { "category": "self", "summary": "VDE-2022-040: WAGO: Multiple Vulnerabilities in Controller with WAGO I/O-Pro / CODESYS 2.3 Runtime - HTML", "url": "https://certvde.com/en/advisories/VDE-2022-040/" }, { "category": "self", "summary": "VDE-2022-040: WAGO: Multiple Vulnerabilities in Controller with WAGO I/O-Pro / CODESYS 2.3 Runtime - CSAF", "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2022/vde-2022-040.json" }, { "category": "external", "summary": "WAGO PSIRT", "url": "https://www.wago.com/psirt" }, { "category": "external", "summary": "CERT@VDE Security Advisories for WAGO GmbH & Co. KG", "url": "https://certvde.com/en/advisories/vendor/wago/" } ], "title": "WAGO: Multiple Vulnerabilities in Controller with WAGO I/O-Pro / CODESYS 2.3 Runtime", "tracking": { "aliases": [ "VDE-2022-040" ], "current_release_date": "2023-09-22T12:39:00.000Z", "generator": { "date": "2025-06-16T07:38:21.972Z", "engine": { "name": "Secvisogram", "version": "2.5.27" } }, "id": "VDE-2022-040", "initial_release_date": "2022-10-17T08:00:00.000Z", "revision_history": [ { "date": "2022-10-17T08:00:00.000Z", "number": "1.0.0", "summary": "Initial revision." }, { "summary": "Solution has updated", "number": "1.1.0", "date": "2023-09-22T12:39:00.000Z" } ], "status": "final", "version": "1.1.0" }, "aggregate_severity": { "namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale", "text": "Critical" } }, "product_tree": { "branches": [ { "name": "Wago", "category": "vendor", "branches": [ { "name": "Hardware", "category": "product_family", "branches": [ { "name": "750-331", "category": "product_name", "product": { "name": "750-331", "product_id": "CSAFPID-11001" } }, { "name": "750-829", "category": "product_name", "product": { "name": "750-829", "product_id": "CSAFPID-11002" } }, { "name": "750-831/xxx-xxx", "category": "product_name", "product": { "name": "750-831/xxx-xxx", "product_id": "CSAFPID-11003" } }, { "name": "750-852", "category": "product_name", "product": { "name": "750-852", "product_id": "CSAFPID-11004" } }, { "name": "750-881", "category": "product_name", "product": { "name": "750-881", "product_id": "CSAFPID-11005" } }, { "name": "750-882", "category": "product_name", "product": { "name": "750-882", "product_id": "CSAFPID-11006" } }, { "name": "750-885/xxx-xxx", "category": "product_name", "product": { "name": "750-885/xxx-xxx", "product_id": "CSAFPID-11007" } }, { "name": "750-889", "category": "product_name", "product": { "name": "750-889", "product_id": "CSAFPID-11008" } }, { "name": "750-880/xxx-xxx", "category": "product_name", "product": { "name": "750-880/xxx-xxx", "product_id": "CSAFPID-11009" } }, { "name": "750-823", "category": "product_name", "product": { "name": "750-823", "product_id": "CSAFPID-11010" } }, { "name": "750-332", "category": "product_name", "product": { "name": "750-332", "product_id": "CSAFPID-11011" } }, { "name": "750-832/xxx-xxx", "category": "product_name", "product": { "name": "750-832/xxx-xxx", "product_id": "CSAFPID-11012" } }, { "name": "750-862", "category": "product_name", "product": { "name": "750-862", "product_id": "CSAFPID-11013" } }, { "name": "750-890/xxx-xxx", "category": "product_name", "product": { "name": "750-890/xxx-xxx", "product_id": "CSAFPID-11014" } }, { "name": "750-891", "category": "product_name", "product": { "name": "750-891", "product_id": "CSAFPID-11015" } }, { "name": "750-893", "category": "product_name", "product": { "name": "750-893", "product_id": "CSAFPID-11016" } }, { "name": "PFC200", "category": "product_name", "product": { "name": "PFC200", "product_id": "CSAFPID-11017", "product_identification_helper": { "model_numbers": [ "750-8206/xxx-xxx", "750-8204/xxx-xxx", "750-8203/xxx-xxx", "750-8214/xxx-xxx", "750-8213/xxx-xxx", "750-8212/xxx-xxx", "750-8211/xxx-xxx", "750-8216/xxx-xxx", "750-8217/xxx-xxx", "750-8210/xxx-xxx", "750-8208/xxx-xxx", "750-8202/xxx-xxx", "750-8207/xxx-xxx" ] } } } ] }, { "name": "Firmware", "category": "product_family", "branches": [ { "name": "<=01.08.25(16)", "category": "product_version_range", "product": { "name": "Firmware <=01.08.25(16)", "product_id": "CSAFPID-21002" } }, { "name": "<=01.03.25(16)", "category": "product_version_range", "product": { "name": "Firmware <=01.03.25(16)", "product_id": "CSAFPID-21003" } }, { "name": "<=01.07.25(16)", "category": "product_version_range", "product": { "name": "Firmware <=01.07.25(16)", "product_id": "CSAFPID-21004" } }, { "name": "<=01.09.25(16)", "category": "product_version_range", "product": { "name": "Firmware <=01.09.25(16)", "product_id": "CSAFPID-21005" } }, { "name": "<=01.04.16(14)", "category": "product_version_range", "product": { "name": "Firmware <=01.04.16(14)", "product_id": "CSAFPID-21006" } }, { "name": "<=01.02.16(06)", "category": "product_version_range", "product": { "name": "Firmware <=01.02.16(06)", "product_id": "CSAFPID-21007" } }, { "name": "<=01.05.04(10)", "category": "product_version_range", "product": { "name": "Firmware <=01.05.04(10)", "product_id": "CSAFPID-21008" } }, { "name": "<=03.10.08(22)", "category": "product_version_range", "product": { "name": "Firmware <=03.10.08(22)", "product_id": "CSAFPID-21009" } }, { "name": "FW17", "category": "product_version", "product": { "name": "Firmware FW17", "product_id": "CSAFPID-22001" } }, { "name": "FW11 with BACnet Certification", "category": "product_version", "product": { "name": "Firmware FW11 with BACnet Certification", "product_id": "CSAFPID-22002" } }, { "name": "FW11", "category": "product_version", "product": { "name": "Firmware FW11", "product_id": "CSAFPID-22003" } } ] }, { "name": "Software", "branches": [ { "name": "Engineering Software", "category": "product_name", "branches": [ { "name": "<=2.3.9.68", "category": "product_version_range", "product": { "name": "Engineering Software <=2.3.9.68", "product_id": "CSAFPID-51001", "product_identification_helper": { "model_numbers": [ "WAGO-I/O-PRO" ] } } }, { "name": "2.3.9.70", "category": "product_version", "product": { "name": "Engineering Software 2.3.9.70", "product_id": "CSAFPID-52001" } } ] } ], "category": "product_family" } ] } ], "product_groups": [ { "group_id": "CSAFGID-0001", "product_ids": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017" ], "summary": "Affected products." }, { "group_id": "CSAFGID-0002", "product_ids": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014" ], "summary": "Fixed products." } ], "relationships": [ { "product_reference": "CSAFPID-21006", "relates_to_product_reference": "CSAFPID-11001", "category": "installed_on", "full_product_name": { "name": "Firmware <=01.04.16(14) installed on 750-331", "product_id": "CSAFPID-31001" } }, { "relates_to_product_reference": "CSAFPID-11002", "product_reference": "CSAFPID-21006", "category": "installed_on", "full_product_name": { "name": "Firmware <=01.04.16(14) installed on 750-829", "product_id": "CSAFPID-31002" } }, { "relates_to_product_reference": "CSAFPID-11003", "product_reference": "CSAFPID-21006", "category": "installed_on", "full_product_name": { "name": "Firmware <=01.04.16(14) installed on 750-831/xxx-xxx", "product_id": "CSAFPID-31003" } }, { "relates_to_product_reference": "CSAFPID-11004", "product_reference": "CSAFPID-21005", "category": "installed_on", "full_product_name": { "name": "Firmware <=01.09.25(16) installed on 750-852", "product_id": "CSAFPID-31004" } }, { "relates_to_product_reference": "CSAFPID-11005", "product_reference": "CSAFPID-21005", "category": "installed_on", "full_product_name": { "name": "Firmware <=01.09.25(16) installed on 750-881", "product_id": "CSAFPID-31005" } }, { "relates_to_product_reference": "CSAFPID-11006", "product_reference": "CSAFPID-21002", "category": "installed_on", "full_product_name": { "name": "Firmware <=01.08.25(16) installed on 750-882", "product_id": "CSAFPID-31006" } }, { "relates_to_product_reference": "CSAFPID-11007", "product_reference": "CSAFPID-21004", "category": "installed_on", "full_product_name": { "name": "Firmware <=01.07.25(16) installed on 750-885/xxx-xxx", "product_id": "CSAFPID-31007" } }, { "relates_to_product_reference": "CSAFPID-11008", "product_reference": "CSAFPID-21003", "category": "installed_on", "full_product_name": { "name": "Firmware <=01.03.25(16) installed on 750-889", "product_id": "CSAFPID-31008" } }, { "relates_to_product_reference": "CSAFPID-11009", "product_reference": "CSAFPID-21002", "category": "installed_on", "full_product_name": { "name": "Firmware <=01.08.25(16) installed on 750-880/xxx-xxx", "product_id": "CSAFPID-31009" } }, { "relates_to_product_reference": "CSAFPID-11010", "product_reference": "CSAFPID-21008", "category": "installed_on", "full_product_name": { "name": "Firmware <=01.05.04(10) installed on 750-823", "product_id": "CSAFPID-31010" } }, { "relates_to_product_reference": "CSAFPID-11011", "product_reference": "CSAFPID-21007", "category": "installed_on", "full_product_name": { "name": "Firmware <=01.02.16(06) installed on 750-332", "product_id": "CSAFPID-31011" } }, { "relates_to_product_reference": "CSAFPID-11012", "product_reference": "CSAFPID-21007", "category": "installed_on", "full_product_name": { "name": "Firmware <=01.02.16(06) installed on 750-832/xxx-xxx", "product_id": "CSAFPID-31012" } }, { "relates_to_product_reference": "CSAFPID-11013", "product_reference": "CSAFPID-21008", "category": "installed_on", "full_product_name": { "name": "Firmware <=01.05.04(10) installed on 750-862", "product_id": "CSAFPID-31013" } }, { "relates_to_product_reference": "CSAFPID-11014", "product_reference": "CSAFPID-21008", "category": "installed_on", "full_product_name": { "name": "Firmware <=01.05.04(10) installed on 750-890/xxx-xxx", "product_id": "CSAFPID-31014" } }, { "relates_to_product_reference": "CSAFPID-11015", "product_reference": "CSAFPID-21008", "category": "installed_on", "full_product_name": { "name": "Firmware <=01.05.04(10) installed on 750-891", "product_id": "CSAFPID-31015" } }, { "relates_to_product_reference": "CSAFPID-11016", "product_reference": "CSAFPID-21008", "category": "installed_on", "full_product_name": { "name": "Firmware <=01.05.04(10) installed on 750-893", "product_id": "CSAFPID-31016" } }, { "relates_to_product_reference": "CSAFPID-11017", "product_reference": "CSAFPID-21009", "category": "installed_on", "full_product_name": { "name": "Firmware <=03.10.08(22) installed on PFC200", "product_id": "CSAFPID-31017" } }, { "relates_to_product_reference": "CSAFPID-11010", "product_reference": "CSAFPID-22003", "category": "installed_on", "full_product_name": { "name": "Firmware FW11 installed on 750-823", "product_id": "CSAFPID-32001" } }, { "relates_to_product_reference": "CSAFPID-11011", "product_reference": "CSAFPID-22002", "category": "installed_on", "full_product_name": { "name": "Firmware FW11 after BACnet Certification installed on 750-332", "product_id": "CSAFPID-32002" } }, { "relates_to_product_reference": "CSAFPID-11012", "product_reference": "CSAFPID-22002", "category": "installed_on", "full_product_name": { "name": "Firmware FW11 after BACnet Certification installed on 750-832/xxx-xxx", "product_id": "CSAFPID-32003" } }, { "relates_to_product_reference": "CSAFPID-11013", "product_reference": "CSAFPID-22003", "category": "installed_on", "full_product_name": { "name": "Firmware FW11 installed on 750-862", "product_id": "CSAFPID-32004" } }, { "relates_to_product_reference": "CSAFPID-11014", "product_reference": "CSAFPID-22003", "category": "installed_on", "full_product_name": { "name": "Firmware FW11 installed on 750-890/xxx-xxx", "product_id": "CSAFPID-32005" } }, { "relates_to_product_reference": "CSAFPID-11015", "product_reference": "CSAFPID-22003", "category": "installed_on", "full_product_name": { "name": "Firmware FW11 installed on 750-891", "product_id": "CSAFPID-32006" } }, { "relates_to_product_reference": "CSAFPID-11016", "product_reference": "CSAFPID-22003", "category": "installed_on", "full_product_name": { "name": "Firmware FW11 installed on 750-893", "product_id": "CSAFPID-32007" } }, { "relates_to_product_reference": "CSAFPID-11002", "product_reference": "CSAFPID-22001", "category": "installed_on", "full_product_name": { "name": "Firmware FW17 installed on 750-829", "product_id": "CSAFPID-32008" } }, { "relates_to_product_reference": "CSAFPID-11004", "product_reference": "CSAFPID-22001", "category": "installed_on", "full_product_name": { "name": "Firmware FW17 installed on 750-852", "product_id": "CSAFPID-32009" } }, { "relates_to_product_reference": "CSAFPID-11009", "product_reference": "CSAFPID-22001", "category": "installed_on", "full_product_name": { "name": "Firmware FW17 installed on 750-880/xxx-xxx", "product_id": "CSAFPID-32010" } }, { "relates_to_product_reference": "CSAFPID-11005", "product_reference": "CSAFPID-22001", "category": "installed_on", "full_product_name": { "name": "Firmware FW17 installed on 750-881", "product_id": "CSAFPID-32011" } }, { "relates_to_product_reference": "CSAFPID-11006", "product_reference": "CSAFPID-22001", "category": "installed_on", "full_product_name": { "name": "Firmware FW17 installed on 750-882", "product_id": "CSAFPID-32012" } }, { "relates_to_product_reference": "CSAFPID-11007", "product_reference": "CSAFPID-22001", "category": "installed_on", "full_product_name": { "name": "Firmware FW17 installed on 750-885/xxx-xxx", "product_id": "CSAFPID-32013" } }, { "relates_to_product_reference": "CSAFPID-11008", "product_reference": "CSAFPID-22001", "category": "installed_on", "full_product_name": { "name": "Firmware FW17 installed on 750-889", "product_id": "CSAFPID-32014" } } ] }, "vulnerabilities": [ { "cve": "CVE-2022-31804", "cwe": { "id": "CWE-789", "name": "Memory Allocation with Excessive Size Value" }, "notes": [ { "category": "description", "text": "The CODESYS Gateway Server V2 does not verifiy that the size of a request is within expected limits. An unauthenticated attacker may allocate an arbitrary amount of memory, which may lead to a crash of the Gateway due to an out-of-memory condition.", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017" ], "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014" ] }, "remediations": [ { "category": "mitigation", "details": "For vulnerabilities CVE-2022-1965, CVE-2022-32136, CVE-2022-32137, CVE-2022-32138, CVE-2022-32139, CVE-2022-32140, CVE-2022-32141, CVE-2022-32142, CVE-2022-32143 (CODESYS Advisory 2022-11):\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n- Setting strong passwords\n- Use e!Runtime or CODESYS V3\n\nFor vulnerabilities CVE-2022-31805, CVE-2022-31806 (CODESYS Advisory 2022-12):\n\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n\n- Use encryption of online communication whenever possible, this protects password transmission.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "group_ids": [ "CSAFGID-0001" ], "details": "WAGO recommends that all affected users with WAGO I/O-PRO/CODESYS 2.3 PLCs update to the firmware and use the latest version of WAGO I/O-Pro as soon as it is available.\nUntil the updates are available, we recommend switching off the CODESYS IP port 2455 after commissioning or, if this not possible, use a strong admin password.\n\n### PFC200 Family\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-8202/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8203/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8204/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8206/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8207/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8208/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8210/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8211/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8212/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8213/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8214/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8216/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8217/xxx-xxx | UPDATE B: Available in Q1 2024 |\n\n### Ethernet Controller 4th Generation Family – UPDATE B\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-823 | UPDATE B: Available in Q1 2024 |\n| 750-332 | UPDATE B: Available in Q1 2024 |\n| 750-832/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-862 | UPDATE B: Available in Q1 2024 |\n| 750-890/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-891 | UPDATE B: Available in Q1 2024 |\n| 750-893 | UPDATE B: Available in Q1 2024 |\n\n### Ethernet Controller 3rd Generation Family – UPDATE B\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-331 | UPDATE B: Available in Q1 2024 |\n| 750-829 | UPDATE B: Available in Q1 2024 |\n| 750-831/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-852 | UPDATE B: Available in Q1 2024 |\n| 750-880/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-881 | UPDATE B: Available in Q1 2024 |\n| 750-882 | UPDATE B: Available in Q1 2024 |\n| 750-885/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-889 | UPDATE B: Available in Q1 2024 |\n\n### Engineering Software\n\n| Name | Firmware |\n|------------------|----------------------------------|\n| WAGO-I/O-PRO 32 | UPDATE B: Available in Q1 2024 |" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 7.5, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017" ] } ], "title": "CVE-2022-31804" }, { "cve": "CVE-2022-31803", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "description", "text": "In CODESYS Gateway Server V2 an insufficient check for the activity of TCP client connections allows an unauthenticated attacker to consume all available TCP connections and prevent legitimate users or clients from establishing a new connection to the CODESYS Gateway Server V2. Existing connections are not affected and therefore remain intact.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017" ] }, "remediations": [ { "category": "mitigation", "details": "For vulnerabilities CVE-2022-1965, CVE-2022-32136, CVE-2022-32137, CVE-2022-32138, CVE-2022-32139, CVE-2022-32140, CVE-2022-32141, CVE-2022-32142, CVE-2022-32143 (CODESYS Advisory 2022-11):\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n- Setting strong passwords\n- Use e!Runtime or CODESYS V3\n\nFor vulnerabilities CVE-2022-31805, CVE-2022-31806 (CODESYS Advisory 2022-12):\n\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n\n- Use encryption of online communication whenever possible, this protects password transmission.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "group_ids": [ "CSAFGID-0001" ], "details": "WAGO recommends that all affected users with WAGO I/O-PRO/CODESYS 2.3 PLCs update to the firmware and use the latest version of WAGO I/O-Pro as soon as it is available.\nUntil the updates are available, we recommend switching off the CODESYS IP port 2455 after commissioning or, if this not possible, use a strong admin password.\n\n### PFC200 Family\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-8202/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8203/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8204/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8206/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8207/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8208/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8210/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8211/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8212/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8213/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8214/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8216/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8217/xxx-xxx | UPDATE B: Available in Q1 2024 |\n\n### Ethernet Controller 4th Generation Family – UPDATE B\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-823 | UPDATE B: Available in Q1 2024 |\n| 750-332 | UPDATE B: Available in Q1 2024 |\n| 750-832/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-862 | UPDATE B: Available in Q1 2024 |\n| 750-890/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-891 | UPDATE B: Available in Q1 2024 |\n| 750-893 | UPDATE B: Available in Q1 2024 |\n\n### Ethernet Controller 3rd Generation Family – UPDATE B\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-331 | UPDATE B: Available in Q1 2024 |\n| 750-829 | UPDATE B: Available in Q1 2024 |\n| 750-831/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-852 | UPDATE B: Available in Q1 2024 |\n| 750-880/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-881 | UPDATE B: Available in Q1 2024 |\n| 750-882 | UPDATE B: Available in Q1 2024 |\n| 750-885/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-889 | UPDATE B: Available in Q1 2024 |\n\n### Engineering Software\n\n| Name | Firmware |\n|------------------|----------------------------------|\n| WAGO-I/O-PRO 32 | UPDATE B: Available in Q1 2024 |" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "environmentalScore": 5.3, "environmentalSeverity": "MEDIUM", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 5.3, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017" ] } ], "title": "CVE-2022-31803" }, { "cve": "CVE-2022-31802", "cwe": { "id": "CWE-187", "name": "Partial String Comparison" }, "notes": [ { "category": "description", "text": "In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared to the real CODESYS Gateway password. An attacker may perform authentication by specifying a small password that matches the corresponding part of the longer real CODESYS Gateway password.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017" ] }, "remediations": [ { "category": "mitigation", "details": "For vulnerabilities CVE-2022-1965, CVE-2022-32136, CVE-2022-32137, CVE-2022-32138, CVE-2022-32139, CVE-2022-32140, CVE-2022-32141, CVE-2022-32142, CVE-2022-32143 (CODESYS Advisory 2022-11):\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n- Setting strong passwords\n- Use e!Runtime or CODESYS V3\n\nFor vulnerabilities CVE-2022-31805, CVE-2022-31806 (CODESYS Advisory 2022-12):\n\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n\n- Use encryption of online communication whenever possible, this protects password transmission.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "group_ids": [ "CSAFGID-0001" ], "details": "WAGO recommends that all affected users with WAGO I/O-PRO/CODESYS 2.3 PLCs update to the firmware and use the latest version of WAGO I/O-Pro as soon as it is available.\nUntil the updates are available, we recommend switching off the CODESYS IP port 2455 after commissioning or, if this not possible, use a strong admin password.\n\n### PFC200 Family\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-8202/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8203/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8204/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8206/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8207/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8208/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8210/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8211/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8212/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8213/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8214/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8216/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8217/xxx-xxx | UPDATE B: Available in Q1 2024 |\n\n### Ethernet Controller 4th Generation Family – UPDATE B\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-823 | UPDATE B: Available in Q1 2024 |\n| 750-332 | UPDATE B: Available in Q1 2024 |\n| 750-832/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-862 | UPDATE B: Available in Q1 2024 |\n| 750-890/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-891 | UPDATE B: Available in Q1 2024 |\n| 750-893 | UPDATE B: Available in Q1 2024 |\n\n### Ethernet Controller 3rd Generation Family – UPDATE B\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-331 | UPDATE B: Available in Q1 2024 |\n| 750-829 | UPDATE B: Available in Q1 2024 |\n| 750-831/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-852 | UPDATE B: Available in Q1 2024 |\n| 750-880/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-881 | UPDATE B: Available in Q1 2024 |\n| 750-882 | UPDATE B: Available in Q1 2024 |\n| 750-885/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-889 | UPDATE B: Available in Q1 2024 |\n\n### Engineering Software\n\n| Name | Firmware |\n|------------------|----------------------------------|\n| WAGO-I/O-PRO 32 | UPDATE B: Available in Q1 2024 |" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017" ] } ], "title": "CVE-2022-31802" }, { "cve": "CVE-2022-31806", "cwe": { "id": "CWE-1188", "name": "Initialization of a Resource with an Insecure Default" }, "notes": [ { "category": "description", "text": "In CODESYS V2 PLCWinNT and Runtime Toolkit 32 in versions prior to V2.4.7.57 password protection is not enabled by default and there is no information or prompt to enable password protection at login in case no password is set at the controller.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017" ] }, "remediations": [ { "category": "mitigation", "details": "For vulnerabilities CVE-2022-1965, CVE-2022-32136, CVE-2022-32137, CVE-2022-32138, CVE-2022-32139, CVE-2022-32140, CVE-2022-32141, CVE-2022-32142, CVE-2022-32143 (CODESYS Advisory 2022-11):\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n- Setting strong passwords\n- Use e!Runtime or CODESYS V3\n\nFor vulnerabilities CVE-2022-31805, CVE-2022-31806 (CODESYS Advisory 2022-12):\n\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n\n- Use encryption of online communication whenever possible, this protects password transmission.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "group_ids": [ "CSAFGID-0001" ], "details": "WAGO recommends that all affected users with WAGO I/O-PRO/CODESYS 2.3 PLCs update to the firmware and use the latest version of WAGO I/O-Pro as soon as it is available.\nUntil the updates are available, we recommend switching off the CODESYS IP port 2455 after commissioning or, if this not possible, use a strong admin password.\n\n### PFC200 Family\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-8202/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8203/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8204/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8206/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8207/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8208/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8210/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8211/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8212/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8213/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8214/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8216/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8217/xxx-xxx | UPDATE B: Available in Q1 2024 |\n\n### Ethernet Controller 4th Generation Family – UPDATE B\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-823 | UPDATE B: Available in Q1 2024 |\n| 750-332 | UPDATE B: Available in Q1 2024 |\n| 750-832/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-862 | UPDATE B: Available in Q1 2024 |\n| 750-890/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-891 | UPDATE B: Available in Q1 2024 |\n| 750-893 | UPDATE B: Available in Q1 2024 |\n\n### Ethernet Controller 3rd Generation Family – UPDATE B\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-331 | UPDATE B: Available in Q1 2024 |\n| 750-829 | UPDATE B: Available in Q1 2024 |\n| 750-831/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-852 | UPDATE B: Available in Q1 2024 |\n| 750-880/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-881 | UPDATE B: Available in Q1 2024 |\n| 750-882 | UPDATE B: Available in Q1 2024 |\n| 750-885/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-889 | UPDATE B: Available in Q1 2024 |\n\n### Engineering Software\n\n| Name | Firmware |\n|------------------|----------------------------------|\n| WAGO-I/O-PRO 32 | UPDATE B: Available in Q1 2024 |" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017" ] } ], "title": "CVE-2022-31806" }, { "cve": "CVE-2022-31805", "cwe": { "id": "CWE-523", "name": "Unprotected Transport of Credentials" }, "notes": [ { "category": "description", "text": "In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017" ] }, "remediations": [ { "category": "mitigation", "details": "For vulnerabilities CVE-2022-1965, CVE-2022-32136, CVE-2022-32137, CVE-2022-32138, CVE-2022-32139, CVE-2022-32140, CVE-2022-32141, CVE-2022-32142, CVE-2022-32143 (CODESYS Advisory 2022-11):\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n- Setting strong passwords\n- Use e!Runtime or CODESYS V3\n\nFor vulnerabilities CVE-2022-31805, CVE-2022-31806 (CODESYS Advisory 2022-12):\n\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n\n- Use encryption of online communication whenever possible, this protects password transmission.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "group_ids": [ "CSAFGID-0001" ], "details": "WAGO recommends that all affected users with WAGO I/O-PRO/CODESYS 2.3 PLCs update to the firmware and use the latest version of WAGO I/O-Pro as soon as it is available.\nUntil the updates are available, we recommend switching off the CODESYS IP port 2455 after commissioning or, if this not possible, use a strong admin password.\n\n### PFC200 Family\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-8202/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8203/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8204/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8206/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8207/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8208/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8210/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8211/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8212/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8213/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8214/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8216/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8217/xxx-xxx | UPDATE B: Available in Q1 2024 |\n\n### Ethernet Controller 4th Generation Family – UPDATE B\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-823 | UPDATE B: Available in Q1 2024 |\n| 750-332 | UPDATE B: Available in Q1 2024 |\n| 750-832/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-862 | UPDATE B: Available in Q1 2024 |\n| 750-890/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-891 | UPDATE B: Available in Q1 2024 |\n| 750-893 | UPDATE B: Available in Q1 2024 |\n\n### Ethernet Controller 3rd Generation Family – UPDATE B\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-331 | UPDATE B: Available in Q1 2024 |\n| 750-829 | UPDATE B: Available in Q1 2024 |\n| 750-831/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-852 | UPDATE B: Available in Q1 2024 |\n| 750-880/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-881 | UPDATE B: Available in Q1 2024 |\n| 750-882 | UPDATE B: Available in Q1 2024 |\n| 750-885/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-889 | UPDATE B: Available in Q1 2024 |\n\n### Engineering Software\n\n| Name | Firmware |\n|------------------|----------------------------------|\n| WAGO-I/O-PRO 32 | UPDATE B: Available in Q1 2024 |" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 7.5, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017" ] } ], "title": "CVE-2022-31805" }, { "cve": "CVE-2022-32143", "cwe": { "id": "CWE-552", "name": "Files or Directories Accessible to External Parties" }, "notes": [ { "category": "description", "text": "In multiple CODESYS products, file download and upload function allows access to internal files in the working directory e.g. firmware files of the PLC. All requests are processed on the controller only if no level 1 password is configured on the controller or if remote attacker has previously successfully authenticated himself to the controller. A successful Attack may lead to a denial of service, change of local files, or drain of confidential Information. User interaction is not required", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017" ] }, "remediations": [ { "category": "mitigation", "details": "For vulnerabilities CVE-2022-1965, CVE-2022-32136, CVE-2022-32137, CVE-2022-32138, CVE-2022-32139, CVE-2022-32140, CVE-2022-32141, CVE-2022-32142, CVE-2022-32143 (CODESYS Advisory 2022-11):\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n- Setting strong passwords\n- Use e!Runtime or CODESYS V3\n\nFor vulnerabilities CVE-2022-31805, CVE-2022-31806 (CODESYS Advisory 2022-12):\n\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n\n- Use encryption of online communication whenever possible, this protects password transmission.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "group_ids": [ "CSAFGID-0001" ], "details": "WAGO recommends that all affected users with WAGO I/O-PRO/CODESYS 2.3 PLCs update to the firmware and use the latest version of WAGO I/O-Pro as soon as it is available.\nUntil the updates are available, we recommend switching off the CODESYS IP port 2455 after commissioning or, if this not possible, use a strong admin password.\n\n### PFC200 Family\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-8202/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8203/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8204/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8206/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8207/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8208/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8210/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8211/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8212/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8213/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8214/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8216/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8217/xxx-xxx | UPDATE B: Available in Q1 2024 |\n\n### Ethernet Controller 4th Generation Family – UPDATE B\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-823 | UPDATE B: Available in Q1 2024 |\n| 750-332 | UPDATE B: Available in Q1 2024 |\n| 750-832/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-862 | UPDATE B: Available in Q1 2024 |\n| 750-890/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-891 | UPDATE B: Available in Q1 2024 |\n| 750-893 | UPDATE B: Available in Q1 2024 |\n\n### Ethernet Controller 3rd Generation Family – UPDATE B\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-331 | UPDATE B: Available in Q1 2024 |\n| 750-829 | UPDATE B: Available in Q1 2024 |\n| 750-831/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-852 | UPDATE B: Available in Q1 2024 |\n| 750-880/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-881 | UPDATE B: Available in Q1 2024 |\n| 750-882 | UPDATE B: Available in Q1 2024 |\n| 750-885/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-889 | UPDATE B: Available in Q1 2024 |\n\n### Engineering Software\n\n| Name | Firmware |\n|------------------|----------------------------------|\n| WAGO-I/O-PRO 32 | UPDATE B: Available in Q1 2024 |" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 8.8, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 8.8, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017" ] } ], "title": "CVE-2022-32143" }, { "cve": "CVE-2022-32142", "cwe": { "id": "CWE-823", "name": "Use of Out-of-range Pointer Offset" }, "notes": [ { "category": "description", "text": "Multiple CODESYS Products are prone to a out-of bounds read or write access. A low privileged remote attacker may craft a request with invalid offset, which can cause an out-of-bounds read or write access, resulting in denial-of-service condition or local memory overwrite, which can lead to a change of local files. User interaction is not required.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017" ] }, "remediations": [ { "category": "mitigation", "details": "For vulnerabilities CVE-2022-1965, CVE-2022-32136, CVE-2022-32137, CVE-2022-32138, CVE-2022-32139, CVE-2022-32140, CVE-2022-32141, CVE-2022-32142, CVE-2022-32143 (CODESYS Advisory 2022-11):\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n- Setting strong passwords\n- Use e!Runtime or CODESYS V3\n\nFor vulnerabilities CVE-2022-31805, CVE-2022-31806 (CODESYS Advisory 2022-12):\n\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n\n- Use encryption of online communication whenever possible, this protects password transmission.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "group_ids": [ "CSAFGID-0001" ], "details": "WAGO recommends that all affected users with WAGO I/O-PRO/CODESYS 2.3 PLCs update to the firmware and use the latest version of WAGO I/O-Pro as soon as it is available.\nUntil the updates are available, we recommend switching off the CODESYS IP port 2455 after commissioning or, if this not possible, use a strong admin password.\n\n### PFC200 Family\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-8202/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8203/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8204/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8206/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8207/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8208/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8210/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8211/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8212/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8213/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8214/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8216/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8217/xxx-xxx | UPDATE B: Available in Q1 2024 |\n\n### Ethernet Controller 4th Generation Family – UPDATE B\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-823 | UPDATE B: Available in Q1 2024 |\n| 750-332 | UPDATE B: Available in Q1 2024 |\n| 750-832/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-862 | UPDATE B: Available in Q1 2024 |\n| 750-890/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-891 | UPDATE B: Available in Q1 2024 |\n| 750-893 | UPDATE B: Available in Q1 2024 |\n\n### Ethernet Controller 3rd Generation Family – UPDATE B\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-331 | UPDATE B: Available in Q1 2024 |\n| 750-829 | UPDATE B: Available in Q1 2024 |\n| 750-831/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-852 | UPDATE B: Available in Q1 2024 |\n| 750-880/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-881 | UPDATE B: Available in Q1 2024 |\n| 750-882 | UPDATE B: Available in Q1 2024 |\n| 750-885/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-889 | UPDATE B: Available in Q1 2024 |\n\n### Engineering Software\n\n| Name | Firmware |\n|------------------|----------------------------------|\n| WAGO-I/O-PRO 32 | UPDATE B: Available in Q1 2024 |" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "environmentalScore": 8.1, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 8.1, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017" ] } ], "title": "CVE-2022-32142" }, { "cve": "CVE-2022-32141", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "Multiple CODESYS Products are prone to a buffer over read. A low privileged remote attacker may craft a request with an invalid offset, which can cause an internal buffer over-read, resulting in a denial-of-service condition. User interaction is not required.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017" ] }, "remediations": [ { "category": "mitigation", "details": "For vulnerabilities CVE-2022-1965, CVE-2022-32136, CVE-2022-32137, CVE-2022-32138, CVE-2022-32139, CVE-2022-32140, CVE-2022-32141, CVE-2022-32142, CVE-2022-32143 (CODESYS Advisory 2022-11):\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n- Setting strong passwords\n- Use e!Runtime or CODESYS V3\n\nFor vulnerabilities CVE-2022-31805, CVE-2022-31806 (CODESYS Advisory 2022-12):\n\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n\n- Use encryption of online communication whenever possible, this protects password transmission.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "group_ids": [ "CSAFGID-0001" ], "details": "WAGO recommends that all affected users with WAGO I/O-PRO/CODESYS 2.3 PLCs update to the firmware and use the latest version of WAGO I/O-Pro as soon as it is available.\nUntil the updates are available, we recommend switching off the CODESYS IP port 2455 after commissioning or, if this not possible, use a strong admin password.\n\n### PFC200 Family\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-8202/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8203/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8204/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8206/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8207/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8208/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8210/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8211/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8212/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8213/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8214/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8216/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8217/xxx-xxx | UPDATE B: Available in Q1 2024 |\n\n### Ethernet Controller 4th Generation Family – UPDATE B\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-823 | UPDATE B: Available in Q1 2024 |\n| 750-332 | UPDATE B: Available in Q1 2024 |\n| 750-832/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-862 | UPDATE B: Available in Q1 2024 |\n| 750-890/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-891 | UPDATE B: Available in Q1 2024 |\n| 750-893 | UPDATE B: Available in Q1 2024 |\n\n### Ethernet Controller 3rd Generation Family – UPDATE B\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-331 | UPDATE B: Available in Q1 2024 |\n| 750-829 | UPDATE B: Available in Q1 2024 |\n| 750-831/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-852 | UPDATE B: Available in Q1 2024 |\n| 750-880/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-881 | UPDATE B: Available in Q1 2024 |\n| 750-882 | UPDATE B: Available in Q1 2024 |\n| 750-885/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-889 | UPDATE B: Available in Q1 2024 |\n\n### Engineering Software\n\n| Name | Firmware |\n|------------------|----------------------------------|\n| WAGO-I/O-PRO 32 | UPDATE B: Available in Q1 2024 |" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "environmentalScore": 6.5, "environmentalSeverity": "MEDIUM", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 6.5, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017" ] } ], "title": "CVE-2022-32141" }, { "cve": "CVE-2022-32140", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')" }, "notes": [ { "category": "description", "text": "Multiple CODESYS products are affected to a buffer overflow.A low privileged remote attacker may craft a request, which can cause a buffer copy without checking the size of the service, resulting in a denial-of-service condition. User Interaction is not required.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017" ] }, "remediations": [ { "category": "mitigation", "details": "For vulnerabilities CVE-2022-1965, CVE-2022-32136, CVE-2022-32137, CVE-2022-32138, CVE-2022-32139, CVE-2022-32140, CVE-2022-32141, CVE-2022-32142, CVE-2022-32143 (CODESYS Advisory 2022-11):\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n- Setting strong passwords\n- Use e!Runtime or CODESYS V3\n\nFor vulnerabilities CVE-2022-31805, CVE-2022-31806 (CODESYS Advisory 2022-12):\n\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n\n- Use encryption of online communication whenever possible, this protects password transmission.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "group_ids": [ "CSAFGID-0001" ], "details": "WAGO recommends that all affected users with WAGO I/O-PRO/CODESYS 2.3 PLCs update to the firmware and use the latest version of WAGO I/O-Pro as soon as it is available.\nUntil the updates are available, we recommend switching off the CODESYS IP port 2455 after commissioning or, if this not possible, use a strong admin password.\n\n### PFC200 Family\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-8202/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8203/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8204/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8206/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8207/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8208/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8210/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8211/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8212/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8213/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8214/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8216/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8217/xxx-xxx | UPDATE B: Available in Q1 2024 |\n\n### Ethernet Controller 4th Generation Family – UPDATE B\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-823 | UPDATE B: Available in Q1 2024 |\n| 750-332 | UPDATE B: Available in Q1 2024 |\n| 750-832/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-862 | UPDATE B: Available in Q1 2024 |\n| 750-890/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-891 | UPDATE B: Available in Q1 2024 |\n| 750-893 | UPDATE B: Available in Q1 2024 |\n\n### Ethernet Controller 3rd Generation Family – UPDATE B\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-331 | UPDATE B: Available in Q1 2024 |\n| 750-829 | UPDATE B: Available in Q1 2024 |\n| 750-831/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-852 | UPDATE B: Available in Q1 2024 |\n| 750-880/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-881 | UPDATE B: Available in Q1 2024 |\n| 750-882 | UPDATE B: Available in Q1 2024 |\n| 750-885/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-889 | UPDATE B: Available in Q1 2024 |\n\n### Engineering Software\n\n| Name | Firmware |\n|------------------|----------------------------------|\n| WAGO-I/O-PRO 32 | UPDATE B: Available in Q1 2024 |" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "environmentalScore": 6.5, "environmentalSeverity": "MEDIUM", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 6.5, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017" ] } ], "title": "CVE-2022-32140" }, { "cve": "CVE-2022-32139", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In multiple CODESYS products, a low privileged remote attacker may craft a request, which cause an out-of-bounds read, resulting in a denial-of-service condition. User Interaction is not required.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017" ] }, "remediations": [ { "category": "mitigation", "details": "For vulnerabilities CVE-2022-1965, CVE-2022-32136, CVE-2022-32137, CVE-2022-32138, CVE-2022-32139, CVE-2022-32140, CVE-2022-32141, CVE-2022-32142, CVE-2022-32143 (CODESYS Advisory 2022-11):\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n- Setting strong passwords\n- Use e!Runtime or CODESYS V3\n\nFor vulnerabilities CVE-2022-31805, CVE-2022-31806 (CODESYS Advisory 2022-12):\n\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n\n- Use encryption of online communication whenever possible, this protects password transmission.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "group_ids": [ "CSAFGID-0001" ], "details": "WAGO recommends that all affected users with WAGO I/O-PRO/CODESYS 2.3 PLCs update to the firmware and use the latest version of WAGO I/O-Pro as soon as it is available.\nUntil the updates are available, we recommend switching off the CODESYS IP port 2455 after commissioning or, if this not possible, use a strong admin password.\n\n### PFC200 Family\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-8202/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8203/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8204/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8206/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8207/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8208/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8210/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8211/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8212/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8213/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8214/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8216/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8217/xxx-xxx | UPDATE B: Available in Q1 2024 |\n\n### Ethernet Controller 4th Generation Family – UPDATE B\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-823 | UPDATE B: Available in Q1 2024 |\n| 750-332 | UPDATE B: Available in Q1 2024 |\n| 750-832/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-862 | UPDATE B: Available in Q1 2024 |\n| 750-890/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-891 | UPDATE B: Available in Q1 2024 |\n| 750-893 | UPDATE B: Available in Q1 2024 |\n\n### Ethernet Controller 3rd Generation Family – UPDATE B\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-331 | UPDATE B: Available in Q1 2024 |\n| 750-829 | UPDATE B: Available in Q1 2024 |\n| 750-831/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-852 | UPDATE B: Available in Q1 2024 |\n| 750-880/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-881 | UPDATE B: Available in Q1 2024 |\n| 750-882 | UPDATE B: Available in Q1 2024 |\n| 750-885/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-889 | UPDATE B: Available in Q1 2024 |\n\n### Engineering Software\n\n| Name | Firmware |\n|------------------|----------------------------------|\n| WAGO-I/O-PRO 32 | UPDATE B: Available in Q1 2024 |" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "environmentalScore": 6.5, "environmentalSeverity": "MEDIUM", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 6.5, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017" ] } ], "title": "CVE-2022-32139" }, { "cve": "CVE-2022-32138", "cwe": { "id": "CWE-194", "name": "Unexpected Sign Extension" }, "notes": [ { "category": "description", "text": "In multiple CODESYS products, a remote attacker may craft a request which may cause an unexpected sign extension, resulting in a denial-of-service condition or memory overwrite.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017" ] }, "remediations": [ { "category": "mitigation", "details": "For vulnerabilities CVE-2022-1965, CVE-2022-32136, CVE-2022-32137, CVE-2022-32138, CVE-2022-32139, CVE-2022-32140, CVE-2022-32141, CVE-2022-32142, CVE-2022-32143 (CODESYS Advisory 2022-11):\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n- Setting strong passwords\n- Use e!Runtime or CODESYS V3\n\nFor vulnerabilities CVE-2022-31805, CVE-2022-31806 (CODESYS Advisory 2022-12):\n\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n\n- Use encryption of online communication whenever possible, this protects password transmission.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "group_ids": [ "CSAFGID-0001" ], "details": "WAGO recommends that all affected users with WAGO I/O-PRO/CODESYS 2.3 PLCs update to the firmware and use the latest version of WAGO I/O-Pro as soon as it is available.\nUntil the updates are available, we recommend switching off the CODESYS IP port 2455 after commissioning or, if this not possible, use a strong admin password.\n\n### PFC200 Family\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-8202/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8203/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8204/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8206/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8207/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8208/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8210/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8211/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8212/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8213/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8214/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8216/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8217/xxx-xxx | UPDATE B: Available in Q1 2024 |\n\n### Ethernet Controller 4th Generation Family – UPDATE B\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-823 | UPDATE B: Available in Q1 2024 |\n| 750-332 | UPDATE B: Available in Q1 2024 |\n| 750-832/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-862 | UPDATE B: Available in Q1 2024 |\n| 750-890/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-891 | UPDATE B: Available in Q1 2024 |\n| 750-893 | UPDATE B: Available in Q1 2024 |\n\n### Ethernet Controller 3rd Generation Family – UPDATE B\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-331 | UPDATE B: Available in Q1 2024 |\n| 750-829 | UPDATE B: Available in Q1 2024 |\n| 750-831/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-852 | UPDATE B: Available in Q1 2024 |\n| 750-880/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-881 | UPDATE B: Available in Q1 2024 |\n| 750-882 | UPDATE B: Available in Q1 2024 |\n| 750-885/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-889 | UPDATE B: Available in Q1 2024 |\n\n### Engineering Software\n\n| Name | Firmware |\n|------------------|----------------------------------|\n| WAGO-I/O-PRO 32 | UPDATE B: Available in Q1 2024 |" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 8.8, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 8.8, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016" ] } ], "title": "CVE-2022-32138" }, { "cve": "CVE-2022-32137", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "In multiple CODESYS products, a low privileged remote attacker may craft a request, which may cause a heap-based buffer overflow, resulting in a denial-of-service condition or memory overwrite. User interaction is not required.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017" ] }, "remediations": [ { "category": "mitigation", "details": "For vulnerabilities CVE-2022-1965, CVE-2022-32136, CVE-2022-32137, CVE-2022-32138, CVE-2022-32139, CVE-2022-32140, CVE-2022-32141, CVE-2022-32142, CVE-2022-32143 (CODESYS Advisory 2022-11):\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n- Setting strong passwords\n- Use e!Runtime or CODESYS V3\n\nFor vulnerabilities CVE-2022-31805, CVE-2022-31806 (CODESYS Advisory 2022-12):\n\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n\n- Use encryption of online communication whenever possible, this protects password transmission.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "group_ids": [ "CSAFGID-0001" ], "details": "WAGO recommends that all affected users with WAGO I/O-PRO/CODESYS 2.3 PLCs update to the firmware and use the latest version of WAGO I/O-Pro as soon as it is available.\nUntil the updates are available, we recommend switching off the CODESYS IP port 2455 after commissioning or, if this not possible, use a strong admin password.\n\n### PFC200 Family\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-8202/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8203/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8204/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8206/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8207/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8208/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8210/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8211/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8212/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8213/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8214/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8216/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8217/xxx-xxx | UPDATE B: Available in Q1 2024 |\n\n### Ethernet Controller 4th Generation Family – UPDATE B\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-823 | UPDATE B: Available in Q1 2024 |\n| 750-332 | UPDATE B: Available in Q1 2024 |\n| 750-832/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-862 | UPDATE B: Available in Q1 2024 |\n| 750-890/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-891 | UPDATE B: Available in Q1 2024 |\n| 750-893 | UPDATE B: Available in Q1 2024 |\n\n### Ethernet Controller 3rd Generation Family – UPDATE B\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-331 | UPDATE B: Available in Q1 2024 |\n| 750-829 | UPDATE B: Available in Q1 2024 |\n| 750-831/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-852 | UPDATE B: Available in Q1 2024 |\n| 750-880/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-881 | UPDATE B: Available in Q1 2024 |\n| 750-882 | UPDATE B: Available in Q1 2024 |\n| 750-885/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-889 | UPDATE B: Available in Q1 2024 |\n\n### Engineering Software\n\n| Name | Firmware |\n|------------------|----------------------------------|\n| WAGO-I/O-PRO 32 | UPDATE B: Available in Q1 2024 |" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 8.8, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 8.8, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017" ] } ], "title": "CVE-2022-32137" }, { "cve": "CVE-2022-32136", "cwe": { "id": "CWE-824", "name": "Access of Uninitialized Pointer" }, "notes": [ { "category": "description", "text": "In multiple CODESYS products, a low privileged remote attacker may craft a request that cause a read access to an uninitialized pointer, resulting in a denial-of-service. User interaction is not required.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017" ] }, "remediations": [ { "category": "mitigation", "details": "For vulnerabilities CVE-2022-1965, CVE-2022-32136, CVE-2022-32137, CVE-2022-32138, CVE-2022-32139, CVE-2022-32140, CVE-2022-32141, CVE-2022-32142, CVE-2022-32143 (CODESYS Advisory 2022-11):\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n- Setting strong passwords\n- Use e!Runtime or CODESYS V3\n\nFor vulnerabilities CVE-2022-31805, CVE-2022-31806 (CODESYS Advisory 2022-12):\n\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n\n- Use encryption of online communication whenever possible, this protects password transmission.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "group_ids": [ "CSAFGID-0001" ], "details": "WAGO recommends that all affected users with WAGO I/O-PRO/CODESYS 2.3 PLCs update to the firmware and use the latest version of WAGO I/O-Pro as soon as it is available.\nUntil the updates are available, we recommend switching off the CODESYS IP port 2455 after commissioning or, if this not possible, use a strong admin password.\n\n### PFC200 Family\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-8202/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8203/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8204/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8206/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8207/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8208/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8210/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8211/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8212/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8213/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8214/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8216/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8217/xxx-xxx | UPDATE B: Available in Q1 2024 |\n\n### Ethernet Controller 4th Generation Family – UPDATE B\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-823 | UPDATE B: Available in Q1 2024 |\n| 750-332 | UPDATE B: Available in Q1 2024 |\n| 750-832/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-862 | UPDATE B: Available in Q1 2024 |\n| 750-890/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-891 | UPDATE B: Available in Q1 2024 |\n| 750-893 | UPDATE B: Available in Q1 2024 |\n\n### Ethernet Controller 3rd Generation Family – UPDATE B\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-331 | UPDATE B: Available in Q1 2024 |\n| 750-829 | UPDATE B: Available in Q1 2024 |\n| 750-831/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-852 | UPDATE B: Available in Q1 2024 |\n| 750-880/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-881 | UPDATE B: Available in Q1 2024 |\n| 750-882 | UPDATE B: Available in Q1 2024 |\n| 750-885/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-889 | UPDATE B: Available in Q1 2024 |\n\n### Engineering Software\n\n| Name | Firmware |\n|------------------|----------------------------------|\n| WAGO-I/O-PRO 32 | UPDATE B: Available in Q1 2024 |" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "environmentalScore": 6.5, "environmentalSeverity": "MEDIUM", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 6.5, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017" ] } ], "title": "CVE-2022-32136" }, { "cve": "CVE-2022-1965", "cwe": { "id": "CWE-755", "name": "Improper Handling of Exceptional Conditions" }, "notes": [ { "category": "description", "text": "Multiple products of CODESYS implement a improper error handling. A low privilege remote attacker may craft a request, which is not properly processed by the error handling. In consequence, the file referenced by the request could be deleted. User interaction is not required.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017" ] }, "remediations": [ { "category": "mitigation", "details": "For vulnerabilities CVE-2022-1965, CVE-2022-32136, CVE-2022-32137, CVE-2022-32138, CVE-2022-32139, CVE-2022-32140, CVE-2022-32141, CVE-2022-32142, CVE-2022-32143 (CODESYS Advisory 2022-11):\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n- Setting strong passwords\n- Use e!Runtime or CODESYS V3\n\nFor vulnerabilities CVE-2022-31805, CVE-2022-31806 (CODESYS Advisory 2022-12):\n\n- Activation of online user management, to prevent unallowed actions from unauthorized attackers\n\n- Use encryption of online communication whenever possible, this protects password transmission.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "group_ids": [ "CSAFGID-0001" ], "details": "WAGO recommends that all affected users with WAGO I/O-PRO/CODESYS 2.3 PLCs update to the firmware and use the latest version of WAGO I/O-Pro as soon as it is available.\nUntil the updates are available, we recommend switching off the CODESYS IP port 2455 after commissioning or, if this not possible, use a strong admin password.\n\n### PFC200 Family\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-8202/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8203/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8204/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8206/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8207/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8208/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8210/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8211/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8212/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8213/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8214/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8216/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-8217/xxx-xxx | UPDATE B: Available in Q1 2024 |\n\n### Ethernet Controller 4th Generation Family – UPDATE B\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-823 | UPDATE B: Available in Q1 2024 |\n| 750-332 | UPDATE B: Available in Q1 2024 |\n| 750-832/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-862 | UPDATE B: Available in Q1 2024 |\n| 750-890/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-891 | UPDATE B: Available in Q1 2024 |\n| 750-893 | UPDATE B: Available in Q1 2024 |\n\n### Ethernet Controller 3rd Generation Family – UPDATE B\n\n| Ord. No. | Firmware |\n|-----------------------|----------------------------------|\n| 750-331 | UPDATE B: Available in Q1 2024 |\n| 750-829 | UPDATE B: Available in Q1 2024 |\n| 750-831/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-852 | UPDATE B: Available in Q1 2024 |\n| 750-880/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-881 | UPDATE B: Available in Q1 2024 |\n| 750-882 | UPDATE B: Available in Q1 2024 |\n| 750-885/xxx-xxx | UPDATE B: Available in Q1 2024 |\n| 750-889 | UPDATE B: Available in Q1 2024 |\n\n### Engineering Software\n\n| Name | Firmware |\n|------------------|----------------------------------|\n| WAGO-I/O-PRO 32 | UPDATE B: Available in Q1 2024 |" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "environmentalScore": 8.1, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 8.1, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017" ] } ], "title": "CVE-2022-1965" } ] } ``` ## [vde-2023-014](https://vulnerability.circl.lu/vuln/vde-2023-014) ```json { "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "A vulnerability allows Bluetooth LE pairing traffic to be sniffed and used to bypass authentication for pairing.", "title": "Summary" }, { "category": "description", "text": "An unauthenticated attacker can acquire the pairing credentials to authenticate itself to an affected Bluetooth Low Energy device in order to use it. The Attack Complexity is high, the attacker must be adjacent to the network and the attacker must interact with the devices to make use of vulnerability.\n\nAdditional resources:\n\n• HMS Security Advisory HMSSAR-2023-05-02-001", "title": "Impact" }, { "category": "description", "text": "Disable Bluetooth LE if not used.", "title": "Mitigation" }, { "category": "description", "text": "No firmware update will be released to fix this issue.", "title": "Remediation" } ], "publisher": { "contact_details": "psirt@wago.com", "name": "WAGO GmbH & Co. KG", "namespace": "https://www.wago.com/psirt", "category": "vendor" }, "references": [ { "category": "self", "summary": "VDE-2023-014: WAGO: Bluetooth LE vulnerability in WLAN-ETHERNET-Gateway - HTML", "url": "https://certvde.com/en/advisories/VDE-2023-014/" }, { "category": "self", "summary": "VDE-2023-014: WAGO: Bluetooth LE vulnerability in WLAN-ETHERNET-Gateway - CSAF", "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2023/vde-2023-014.json" }, { "category": "external", "summary": "Vendor PSIRT", "url": "https://www.wago.com/psirt" }, { "category": "external", "summary": "CERT@VDE Security Advisories for WAGO GmbH & Co. KG", "url": "https://certvde.com/en/advisories/vendor/wago/" } ], "title": "WAGO: Bluetooth LE vulnerability in WLAN-ETHERNET-Gateway", "tracking": { "aliases": [ "VDE-2023-014" ], "current_release_date": "2023-07-31T07:00:00.000Z", "generator": { "date": "2025-05-14T13:20:05.072Z", "engine": { "name": "Secvisogram", "version": "2.5.25" } }, "id": "VDE-2023-014", "initial_release_date": "2023-07-31T07:00:00.000Z", "revision_history": [ { "date": "2023-07-31T07:00:00.000Z", "number": "1", "summary": "Initial revision." } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "name": "WAGO", "category": "vendor", "branches": [ { "name": "Hardware", "category": "product_family", "branches": [ { "name": "WAGO WLAN ETHERNET Gateway", "category": "product_name", "product": { "name": "WAGO WLAN ETHERNET Gateway", "product_id": "CSAFPID-11001", "product_identification_helper": { "model_numbers": [ "758-918/0000-0001", "758-918" ] } } } ] }, { "name": "Firmware", "category": "product_family", "branches": [ { "name": "vers:all/*", "category": "product_version_range", "product": { "name": "Firmware vers:all/*", "product_id": "CSAFPID-21001" } } ] } ] } ], "relationships": [ { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11001", "category": "installed_on", "full_product_name": { "name": "Firmware vers:all/* installed on WAGO WLAN ETHERNET Gateway", "product_id": "CSAFPID-31001" } } ] }, "vulnerabilities": [ { "cve": "CVE-2022-25836", "cwe": { "id": "CWE-294", "name": "Authentication Bypass by Capture-replay" }, "notes": [ { "category": "description", "text": "Bluetooth® Low Energy Pairing in Bluetooth Core Specification v4.0 through v5.3 may permit an unauthenticated MITM to acquire credentials with two pairing devices via adjacent access when the MITM negotiates Legacy Passkey Pairing with the pairing Initiator and Secure Connections Passkey Pairing with the pairing Responder and brute forces the Passkey entered by the user into the Initiator. The MITM attacker can use the identified Passkey value to complete authentication with the Responder via Bluetooth pairing method confusion.", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001" ] }, "remediations": [ { "category": "mitigation", "details": "Disable Bluetooth LE if not used.", "product_ids": [ "CSAFPID-31001" ] }, { "category": "no_fix_planned", "details": "No firmware update will be released to fix this issue.", "product_ids": [ "CSAFPID-31001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "temporalScore": 7.5, "temporalSeverity": "HIGH", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N", "version": "3.1" }, "products": [ "CSAFPID-31001" ] } ], "title": "CVE-2022-25836" } ] } ``` ## [vde-2023-005](https://vulnerability.circl.lu/vuln/vde-2023-005) ```json { "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] }, { "organization": "Kaspersky", "names": [ "Roman Ezhov" ] } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "An unauthenticated attacker with network access to port 502/TCP of the target device can cause a denial-of-service condition by sending multiple specially crafted packets. The MODBUS server does not properly release memory resources that were reserved for incomplete connection attempts by MODBUS clients. This could allow a remote attacker to generate a denial of service condition on devices that incorporate a vulnerable version of the MODBUS server.", "title": "Summary" }, { "category": "description", "text": "Abusing this vulnerability an attacker can crash an affected product, which fully prevents the product to work as intended. After a complete restart the component works as expected.", "title": "Impact" }, { "category": "description", "text": "In case no MODBUS communication is needed the MODBUS-Server should be deactivated in the product settings of the web-based management.\n\nAs general security measures WAGO strongly recommends:\n\n1. Use general security best practices to protect systems from local and network attacks.\n2. Do not allow direct access to the device from untrusted networks.\n3. Update to the latest firmware according to the table in chapter solutions.\n4. Industrial control systems (ICS) should not be directly accessible from the Internet, but should be protected by consistently applying the defense-in-depth strategy. The BSI provides general information on securing ICS in the ICS Compendium (www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/ICS/ICS-Security_compendium.pdf).", "title": "Mitigation" }, { "category": "description", "text": "We recommend all affected users to update to the firmware version listed below:\n\n### Series WAGO 750-3x/-8x\n\n| Article Number | Fixed in Firmware Version |\n|----------------------|----------------------------------------|\n| 750-332 | FW11 after BACnet certification |\n| 750-362/xxx-xxx | FW11 Q3/2023 |\n| 750-363/xxx-xxx | FW11 Q3/2023 |\n| 750-364/xxx-xxx | FW11 Q3/2023 |\n| 750-365/xxx-xxx | FW11 Q3/2023 |\n| 750-823 | FW11 Q3/2023 |\n| 750-832/xxx-xxx | FW11 after BACnet certification |\n| 750-862 | FW11 Q1/2023 |\n| 750-890/xxx-xxx | FW11 Q3/2023 |\n| 750-891 | FW11 Q3/2023 |\n| 750-893 | FW11 Q3/2023 |", "title": "Remediation" } ], "publisher": { "contact_details": "psirt@wago.com", "name": "WAGO GmbH & Co. KG", "namespace": "https://www.wago.com/psirt", "category": "vendor" }, "references": [ { "category": "self", "summary": "VDE-2023-005: WAGO: Series 750-3x/-8x prone to MODBUS server DoS - HTML", "url": "https://certvde.com/en/advisories/VDE-2023-005/" }, { "category": "self", "summary": "VDE-2023-005: WAGO: Series 750-3x/-8x prone to MODBUS server DoS - CSAF", "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2023/vde-2023-005.json" }, { "category": "external", "summary": "Vendor PSIRT", "url": "https://www.wago.com/psirt" }, { "category": "external", "summary": "CERT@VDE Security Advisories for WAGO GmbH & Co. KG", "url": "https://certvde.com/en/advisories/vendor/wago/" } ], "title": "WAGO: Series 750-3x/-8x prone to MODBUS server DoS", "tracking": { "aliases": [ "VDE-2023-005" ], "current_release_date": "2023-06-25T06:00:00.000Z", "generator": { "date": "2025-05-08T11:09:08.909Z", "engine": { "name": "Secvisogram", "version": "2.5.25" } }, "id": "VDE-2023-005", "initial_release_date": "2023-06-25T06:00:00.000Z", "revision_history": [ { "date": "2023-06-25T06:00:00.000Z", "number": "1", "summary": "Initial revision." } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "name": "WAGO", "category": "vendor", "branches": [ { "name": "Hardware", "branches": [ { "name": "BACnet/IP Controller (4th Gen)", "category": "product_name", "product": { "name": "BACnet/IP Controller (4th Gen)", "product_id": "CSAFPID-11001", "product_identification_helper": { "model_numbers": [ "750-832/xxx-xxx" ] } } }, { "name": "BACnet/IP Fieldbus Coupler (4th Gen)", "category": "product_name", "product": { "name": "BACnet/IP Fieldbus Coupler (4th Gen)", "product_id": "CSAFPID-11002", "product_identification_helper": { "model_numbers": [ "750-332" ] } } }, { "name": "EtherNet/IP Controller (4th Gen)", "category": "product_name", "product": { "name": "EtherNet/IP Controller (4th Gen)", "product_id": "CSAFPID-11003", "product_identification_helper": { "model_numbers": [ "750-823", "750-893" ] } } }, { "name": "EtherNet/IP Fieldbus Coupler (4th Gen)", "category": "product_name", "product": { "name": "EtherNet/IP Fieldbus Coupler (4th Gen)", "product_id": "CSAFPID-11004", "product_identification_helper": { "model_numbers": [ "750-363/xxx-xxx" ] } } }, { "name": "EtherNet/IP M12 Fieldbus Coupler (4th Gen)", "category": "product_name", "product": { "name": "EtherNet/IP M12 Fieldbus Coupler (4th Gen)", "product_id": "CSAFPID-11005", "product_identification_helper": { "model_numbers": [ "750-365/xxx-xxx" ] } } }, { "name": "Modbus TCP Controller (4th Gen)", "category": "product_name", "product": { "name": "Modbus TCP Controller (4th Gen)", "product_id": "CSAFPID-11006", "product_identification_helper": { "model_numbers": [ "750-862", "750-890/xxx-xxx", "750-891" ] } } }, { "name": "Modbus TCP Fieldbus Coupler (4th Gen)", "category": "product_name", "product": { "name": "Modbus TCP Fieldbus Coupler (4th Gen)", "product_id": "CSAFPID-11007", "product_identification_helper": { "model_numbers": [ "750-362/xxx-xxx" ] } } }, { "name": "Modbus TCP M12 Fieldbus Coupler (4th Gen)", "product": { "name": "Modbus TCP M12 Fieldbus Coupler (4th Gen)", "product_id": "CSAFPID-11008", "product_identification_helper": { "model_numbers": [ "750-364/xxx-xxx" ] } }, "category": "product_name" } ], "category": "product_name" }, { "name": "Fimware", "branches": [ { "name": "<=FW10", "category": "product_version_range", "product": { "name": "Fimware <=FW10", "product_id": "CSAFPID-21001" } }, { "name": "FW11", "category": "product_version", "product": { "name": "Fimware FW11", "product_id": "CSAFPID-22001" } }, { "name": "FW11 after BACnet certification", "category": "product_version", "product": { "name": "Fimware FW11 after BACnet certification", "product_id": "CSAFPID-22002" } } ], "category": "product_family" } ] } ], "product_groups": [ { "group_id": "CSAFGID-0001", "product_ids": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008" ], "summary": "Affected products." }, { "group_id": "CSAFGID-0002", "product_ids": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008" ], "summary": "Fixed products." } ], "relationships": [ { "relates_to_product_reference": "CSAFPID-11001", "product_reference": "CSAFPID-21001", "category": "installed_on", "full_product_name": { "name": "Fimware <=FW10 installed on BACnet/IP Controller (4th Gen)", "product_id": "CSAFPID-31001" } }, { "relates_to_product_reference": "CSAFPID-11002", "product_reference": "CSAFPID-21001", "category": "installed_on", "full_product_name": { "name": "Fimware <=FW10 installed on BACnet/IP Fieldbus Coupler (4th Gen)", "product_id": "CSAFPID-31002" } }, { "relates_to_product_reference": "CSAFPID-11003", "product_reference": "CSAFPID-21001", "category": "installed_on", "full_product_name": { "name": "Fimware <=FW10 installed on EtherNet/IP Controller (4th Gen)", "product_id": "CSAFPID-31003" } }, { "relates_to_product_reference": "CSAFPID-11004", "product_reference": "CSAFPID-21001", "category": "installed_on", "full_product_name": { "name": "Fimware <=FW10 installed on EtherNet/IP Fieldbus Coupler (4th Gen)", "product_id": "CSAFPID-31004" } }, { "relates_to_product_reference": "CSAFPID-11005", "product_reference": "CSAFPID-21001", "category": "installed_on", "full_product_name": { "name": "Fimware <=FW10 installed on EtherNet/IP M12 Fieldbus Coupler (4th Gen)", "product_id": "CSAFPID-31005" } }, { "relates_to_product_reference": "CSAFPID-11006", "product_reference": "CSAFPID-21001", "category": "installed_on", "full_product_name": { "name": "Fimware <=FW10 installed on Modbus TCP Controller (4th Gen)", "product_id": "CSAFPID-31006" } }, { "relates_to_product_reference": "CSAFPID-11007", "product_reference": "CSAFPID-21001", "category": "installed_on", "full_product_name": { "name": "Fimware <=FW10 installed on Modbus TCP Fieldbus Coupler (4th Gen)", "product_id": "CSAFPID-31007" } }, { "relates_to_product_reference": "CSAFPID-11008", "product_reference": "CSAFPID-21001", "category": "installed_on", "full_product_name": { "name": "Fimware <=FW10 installed on Modbus TCP M12 Fieldbus Coupler (4th Gen)", "product_id": "CSAFPID-31008" } }, { "relates_to_product_reference": "CSAFPID-11002", "product_reference": "CSAFPID-22002", "category": "installed_on", "full_product_name": { "name": "Fimware FW11 after BACnet certification installed on BACnet/IP Fieldbus Coupler (4th Gen)", "product_id": "CSAFPID-32001" } }, { "relates_to_product_reference": "CSAFPID-11007", "product_reference": "CSAFPID-22001", "category": "installed_on", "full_product_name": { "name": "Fimware FW11 installed on Modbus TCP Fieldbus Coupler (4th Gen)", "product_id": "CSAFPID-32002" } }, { "relates_to_product_reference": "CSAFPID-11004", "product_reference": "CSAFPID-22001", "category": "installed_on", "full_product_name": { "name": "Fimware FW11 installed on EtherNet/IP Fieldbus Coupler (4th Gen)", "product_id": "CSAFPID-32003" } }, { "relates_to_product_reference": "CSAFPID-11008", "product_reference": "CSAFPID-22001", "category": "installed_on", "full_product_name": { "name": "Fimware FW11 installed on Modbus TCP M12 Fieldbus Coupler (4th Gen)", "product_id": "CSAFPID-32004" } }, { "relates_to_product_reference": "CSAFPID-11005", "product_reference": "CSAFPID-22001", "category": "installed_on", "full_product_name": { "name": "Fimware FW11 installed on EtherNet/IP M12 Fieldbus Coupler (4th Gen)", "product_id": "CSAFPID-32005" } }, { "relates_to_product_reference": "CSAFPID-11003", "product_reference": "CSAFPID-22001", "category": "installed_on", "full_product_name": { "name": "Fimware FW11 installed on EtherNet/IP Controller (4th Gen)", "product_id": "CSAFPID-32006" } }, { "relates_to_product_reference": "CSAFPID-11001", "product_reference": "CSAFPID-22002", "category": "installed_on", "full_product_name": { "name": "Fimware FW11 after BACnet certification installed on BACnet/IP Controller (4th Gen)", "product_id": "CSAFPID-32007" } }, { "relates_to_product_reference": "CSAFPID-11006", "product_reference": "CSAFPID-22001", "category": "installed_on", "full_product_name": { "name": "Fimware FW11 installed on Modbus TCP Controller (4th Gen)", "product_id": "CSAFPID-32008" } } ] }, "vulnerabilities": [ { "cve": "CVE-2023-1150", "cwe": { "id": "CWE-772", "name": "Missing Release of Resource after Effective Lifetime" }, "notes": [ { "category": "description", "text": "Uncontrolled resource consumption in Series WAGO 750-3x/-8x products may allow an unauthenticated remote attacker to DoS the MODBUS server with specially crafted packets.", "title": "Vulnerability Description" } ], "remediations": [ { "category": "mitigation", "details": "In case no MODBUS communication is needed the MODBUS-Server should be deactivated in the product settings of the web-based management.\n\nAs general security measures WAGO strongly recommends:\n\n1. Use general security best practices to protect systems from local and network attacks.\n2. Do not allow direct access to the device from untrusted networks.\n3. Update to the latest firmware according to the table in chapter solutions.\n4. Industrial control systems (ICS) should not be directly accessible from the Internet, but should be protected by consistently applying the defense-in-depth strategy. The BSI provides general information on securing ICS in the ICS Compendium (www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/ICS/ICS-Security_compendium.pdf).", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "We recommend all affected users to update to the firmware version listed below:\n\n### Series WAGO 750-3x/-8x\n\n| Article Number | Fixed in Firmware Version |\n|----------------------|----------------------------------------|\n| 750-332 | FW11 after BACnet certification |\n| 750-362/xxx-xxx | FW11 Q3/2023 |\n| 750-363/xxx-xxx | FW11 Q3/2023 |\n| 750-364/xxx-xxx | FW11 Q3/2023 |\n| 750-365/xxx-xxx | FW11 Q3/2023 |\n| 750-823 | FW11 Q3/2023 |\n| 750-832/xxx-xxx | FW11 after BACnet certification |\n| 750-862 | FW11 Q1/2023 |\n| 750-890/xxx-xxx | FW11 Q3/2023 |\n| 750-891 | FW11 Q3/2023 |\n| 750-893 | FW11 Q3/2023 |", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 7.5, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008" ] } ], "title": "CVE-2023-1150", "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008" ], "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008" ] } } ] } ``` ## [vde-2022-060](https://vulnerability.circl.lu/vuln/vde-2022-060) ```json { "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] }, { "organization": "Georgia Institute of Technology's Cyber-Physical Security Lab", "summary": "reporting", "names": [ "Ryan Pickren" ] } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "The Web-Based Management (WBM) of WAGOs programmable logic controller (PLC) is typically used for administration, commissioning and updates.\nThe configuration backend can in some cases be used without authentication and to write data with root privileges. Additionally, the web-based management suffers a CORS misconfiguration and allows reflected XSS (Cross-Site Scripting) attacks.", "title": "Summary" }, { "category": "description", "text": "The web-based management of affected products is vulnerable to Reflective Cross-Site Scripting. This can be used to install malicious code and to gain access to confidential information on a System that connects to the WBM after it has been compromised.\nAdditionally, the web-based management of affected products is vulnerable to stealing and setting device parameters and remote code execution by an unauthenticated attacker.", "title": "Impact" }, { "category": "description", "text": "- If not needed, you can deactivate the web-based management to prevent attacks (command line)\n- Restrict network access to the device.\n- Do not directly connect the device to the internet", "title": "Mitigation" }, { "category": "description", "text": "We recommend all users of affected products to install FW22 Patch 1 or FW24 or higher.", "title": "Remediation" } ], "publisher": { "contact_details": "psirt@wago.com", "name": "WAGO GmbH & Co. KG", "namespace": "https://www.wago.com/psirt", "category": "vendor" }, "references": [ { "category": "self", "summary": "VDE-2022-060: WAGO: Multiple vulnerabilities in web-based management of multiple products - HTML", "url": "https://certvde.com/en/advisories/VDE-2022-060/" }, { "category": "self", "summary": "VDE-2022-060: WAGO: Multiple vulnerabilities in web-based management of multiple products - CSAF", "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2023/vde-2022-060.json" }, { "category": "external", "summary": "Vendor PSIRT", "url": "https://www.wago.com/psirt" }, { "category": "external", "summary": "CERT@VDE Security Advisories for WAGO GmbH & Co. KG", "url": "https://certvde.com/en/advisories/vendor/wago/" } ], "title": "WAGO: Multiple vulnerabilities in web-based management of multiple products", "tracking": { "aliases": [ "VDE-2022-060" ], "current_release_date": "2023-02-27T11:00:00.000Z", "generator": { "date": "2025-05-05T11:28:57.463Z", "engine": { "name": "Secvisogram", "version": "2.5.24" } }, "id": "VDE-2022-060", "initial_release_date": "2023-02-27T11:00:00.000Z", "revision_history": [ { "date": "2023-02-27T11:00:00.000Z", "number": "1", "summary": "Initial revision." } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "name": "WAGO", "category": "vendor", "branches": [ { "name": "Hardware", "category": "product_family", "branches": [ { "name": "Compact Controller 100", "category": "product_name", "product": { "name": "Compact Controller 100", "product_id": "CSAFPID-11001", "product_identification_helper": { "model_numbers": [ "751-9301" ] } } }, { "name": "Edge Controller", "category": "product_name", "product": { "name": "Edge Controller", "product_id": "CSAFPID-11002", "product_identification_helper": { "model_numbers": [ "752-8303/8000-002" ] } } }, { "name": "PFC100", "category": "product_name", "product": { "name": "PFC100", "product_id": "CSAFPID-11003", "product_identification_helper": { "model_numbers": [ "750-81xx/xxx-xxx" ] } } }, { "name": "PFC200", "category": "product_name", "product": { "name": "PFC200", "product_id": "CSAFPID-11004", "product_identification_helper": { "model_numbers": [ "750-82xx/xxx-xxx" ] } } }, { "name": "Touch Panel 600 Advanced Line", "category": "product_name", "product": { "name": "Touch Panel 600 Advanced Line", "product_id": "CSAFPID-11005", "product_identification_helper": { "model_numbers": [ "762-5xxx" ] } } }, { "name": "Touch Panel 600 Marine Line", "category": "product_name", "product": { "name": "Touch Panel 600 Marine Line", "product_id": "CSAFPID-11006", "product_identification_helper": { "model_numbers": [ "762-6xxx" ] } } }, { "name": "Touch Panel 600 Standard Line", "category": "product_name", "product": { "name": "Touch Panel 600 Standard Line", "product_id": "CSAFPID-11007", "product_identification_helper": { "model_numbers": [ "762-4xxx" ] } } } ] }, { "name": "Firmware", "category": "product_family", "branches": [ { "name": "FW16<=FW22", "category": "product_version_range", "product": { "name": "Firmware FW16<=FW22", "product_id": "CSAFPID-21001" } }, { "name": "FW23", "category": "product_version", "product": { "name": "Firmware FW23", "product_id": "CSAFPID-21002" } }, { "name": "FW18<=FW22", "category": "product_version_range", "product": { "name": "Firmware FW18<=FW22", "product_id": "CSAFPID-21003" } }, { "name": "FW22 Patch 1", "category": "product_version", "product": { "name": "Firmware FW22 Patch 1", "product_id": "CSAFPID-22001" } }, { "name": "FW24", "category": "product_version", "product": { "name": "Firmware FW24", "product_id": "CSAFPID-22002" } } ] } ] } ], "product_groups": [ { "group_id": "CSAFGID-0001", "product_ids": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014" ], "summary": "Affected products." }, { "group_id": "CSAFGID-0002", "product_ids": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014" ], "summary": "Fixed products." } ], "relationships": [ { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11001", "category": "installed_on", "full_product_name": { "name": "Firmware FW16<=FW22 installed on Compact Controller 100", "product_id": "CSAFPID-31001" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11001", "category": "installed_on", "full_product_name": { "name": "Firmware FW23 installed on Compact Controller 100", "product_id": "CSAFPID-31002" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11002", "category": "installed_on", "full_product_name": { "name": "Firmware FW23 installed on Edge Controller", "product_id": "CSAFPID-31003" } }, { "product_reference": "CSAFPID-21003", "relates_to_product_reference": "CSAFPID-11002", "category": "installed_on", "full_product_name": { "name": "Firmware FW18<=FW22 installed on Edge Controller", "product_id": "CSAFPID-31004" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11003", "category": "installed_on", "full_product_name": { "name": "Firmware FW23 installed on PFC100", "product_id": "CSAFPID-31005" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11003", "category": "installed_on", "full_product_name": { "name": "Firmware FW16<=FW22 installed on PFC100", "product_id": "CSAFPID-31006" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11004", "category": "installed_on", "full_product_name": { "name": "Firmware FW16<=FW22 installed on PFC200", "product_id": "CSAFPID-31007" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11004", "category": "installed_on", "full_product_name": { "name": "Firmware FW23 installed on PFC200", "product_id": "CSAFPID-31008" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11005", "category": "installed_on", "full_product_name": { "name": "Firmware FW16<=FW22 installed on Touch Panel 600 Advanced Line", "product_id": "CSAFPID-31009" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11005", "category": "installed_on", "full_product_name": { "name": "Firmware FW23 installed on Touch Panel 600 Advanced Line", "product_id": "CSAFPID-31010" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11006", "category": "installed_on", "full_product_name": { "name": "Firmware FW16<=FW22 installed on Touch Panel 600 Marine Line", "product_id": "CSAFPID-31011" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11006", "category": "installed_on", "full_product_name": { "name": "Firmware FW23 installed on Touch Panel 600 Marine Line", "product_id": "CSAFPID-31012" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11007", "category": "installed_on", "full_product_name": { "name": "Firmware FW23 installed on Touch Panel 600 Standard Line", "product_id": "CSAFPID-31013" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11007", "category": "installed_on", "full_product_name": { "name": "Firmware FW16<=FW22 installed on Touch Panel 600 Standard Line", "product_id": "CSAFPID-31014" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11001", "category": "installed_on", "full_product_name": { "name": "Firmware FW22 Patch 1 installed on Compact Controller 100", "product_id": "CSAFPID-32001" } }, { "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11001", "category": "installed_on", "full_product_name": { "name": "Firmware FW24 installed on Compact Controller 100", "product_id": "CSAFPID-32002" } }, { "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11002", "category": "installed_on", "full_product_name": { "name": "Firmware FW24 installed on Edge Controller", "product_id": "CSAFPID-32003" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11002", "category": "installed_on", "full_product_name": { "name": "Firmware FW22 Patch 1 installed on Edge Controller", "product_id": "CSAFPID-32004" } }, { "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11003", "category": "installed_on", "full_product_name": { "name": "Firmware FW24 installed on PFC100", "product_id": "CSAFPID-32005" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11003", "category": "installed_on", "full_product_name": { "name": "Firmware FW22 Patch 1 installed on PFC100", "product_id": "CSAFPID-32006" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11004", "category": "installed_on", "full_product_name": { "name": "Firmware FW22 Patch 1 installed on PFC200", "product_id": "CSAFPID-32007" } }, { "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11004", "category": "installed_on", "full_product_name": { "name": "Firmware FW24 installed on PFC200", "product_id": "CSAFPID-32008" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11005", "category": "installed_on", "full_product_name": { "name": "Firmware FW22 Patch 1 installed on Touch Panel 600 Advanced Line", "product_id": "CSAFPID-32009" } }, { "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11005", "category": "installed_on", "full_product_name": { "name": "Firmware FW24 installed on Touch Panel 600 Advanced Line", "product_id": "CSAFPID-32010" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11006", "category": "installed_on", "full_product_name": { "name": "Firmware FW22 Patch 1 installed on Touch Panel 600 Marine Line", "product_id": "CSAFPID-32011" } }, { "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11006", "category": "installed_on", "full_product_name": { "name": "Firmware FW24 installed on Touch Panel 600 Marine Line", "product_id": "CSAFPID-32012" } }, { "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11007", "category": "installed_on", "full_product_name": { "name": "Firmware FW24 installed on Touch Panel 600 Standard Line", "product_id": "CSAFPID-32013" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11007", "category": "installed_on", "full_product_name": { "name": "Firmware FW22 Patch 1 installed on Touch Panel 600 Standard Line", "product_id": "CSAFPID-32014" } } ] }, "vulnerabilities": [ { "cve": "CVE-2022-45138", "cwe": { "id": "CWE-306", "name": "Missing Authentication for Critical Function" }, "notes": [ { "category": "description", "text": "The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API. The vulnerability allows an unauthenticated attacker to read and set several device parameters that can lead to full compromise of the device.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014" ] }, "remediations": [ { "category": "mitigation", "details": "- If not needed, you can deactivate the web-based management to prevent attacks (command line)\n- Restrict network access to the device.\n- Do not directly connect the device to the internet", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "We recommend all users of affected products to install FW22 Patch 1 or FW24 or higher.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014" ] } ], "title": "CVE-2022-45138" }, { "cve": "CVE-2022-45137", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "notes": [ { "category": "description", "text": "The configuration backend of the web-based management is vulnerable to reflected XSS (Cross-Site Scripting) attacks that targets the users browser. This leads to a limited impact of confidentiality and integrity but no impact of availability.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014" ] }, "remediations": [ { "category": "mitigation", "details": "- If not needed, you can deactivate the web-based management to prevent attacks (command line)\n- Restrict network access to the device.\n- Do not directly connect the device to the internet", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "We recommend all users of affected products to install FW22 Patch 1 or FW24 or higher.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "environmentalScore": 6.1, "environmentalSeverity": "MEDIUM", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "temporalScore": 6.1, "temporalSeverity": "MEDIUM", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014" ] } ], "title": "CVE-2022-45137" }, { "cve": "CVE-2022-45140", "cwe": { "id": "CWE-306", "name": "Missing Authentication for Critical Function" }, "notes": [ { "category": "description", "text": "The configuration backend allows an unauthenticated user to write arbitrary data with root privileges to the storage, which could lead to unauthenticated remote code execution and full system compromise.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014" ] }, "remediations": [ { "category": "mitigation", "details": "- If not needed, you can deactivate the web-based management to prevent attacks (command line)\n- Restrict network access to the device.\n- Do not directly connect the device to the internet", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "We recommend all users of affected products to install FW22 Patch 1 or FW24 or higher.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014" ] } ], "title": "CVE-2022-45140" }, { "cve": "CVE-2022-45139", "cwe": { "id": "CWE-346", "name": "Origin Validation Error" }, "notes": [ { "category": "description", "text": "A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of information readable the impact only affects a small subset of confidentiality.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014" ] }, "remediations": [ { "category": "mitigation", "details": "- If not needed, you can deactivate the web-based management to prevent attacks (command line)\n- Restrict network access to the device.\n- Do not directly connect the device to the internet", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "We recommend all users of affected products to install FW22 Patch 1 or FW24 or higher.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "environmentalScore": 5.3, "environmentalSeverity": "MEDIUM", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 5.3, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014" ] } ], "title": "CVE-2022-45139" } ] } ``` ## [vde-2022-055](https://vulnerability.circl.lu/vuln/vde-2022-055) ```json { "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "An unknown and undocumented configuration interface with limited functionality was identified on the affected devices.", "title": "Summary" }, { "category": "description", "text": "An unprivileged attacker can configure network setting to violate confidentiality of transferred packages if the network packages themselves are not protected by cryptographic measures. Additionally, the attacker can violate the availability of network clients by changing network settings (e.g., deactivate network ports).", "title": "Impact" }, { "category": "description", "text": "Restrict network access to the device.\nDo not directly connect the device to the internet", "title": "Mitigation" }, { "category": "description", "text": "A firmware update which fixes the problem is available. Users who want to do a firmware update should contact the WAGO support.", "title": "Remediation" } ], "publisher": { "contact_details": "psirt@wago.com", "name": "WAGO GmbH & Co. KG", "namespace": "https://www.wago.com/psirt", "category": "vendor" }, "references": [ { "category": "self", "summary": "VDE-2022-055: WAGO: Exposure of configuration interface in unmanaged switches - HTML", "url": "https://certvde.com/en/advisories/VDE-2022-055/" }, { "category": "self", "summary": "VDE-2022-055: WAGO: Exposure of configuration interface in unmanaged switches - CSAF", "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2023/vde-2022-055.json" }, { "category": "external", "summary": "Vendor PSIRT", "url": "https://www.wago.com/psirt" }, { "category": "external", "summary": "CERT@VDE Security Advisories for WAGO GmbH & Co. KG", "url": "https://certvde.com/en/advisories/vendor/wago/" } ], "title": "WAGO: Exposure of configuration interface in unmanaged switches", "tracking": { "aliases": [ "VDE-2022-055" ], "current_release_date": "2023-02-16T13:43:00.000Z", "generator": { "date": "2025-05-14T13:22:35.925Z", "engine": { "name": "Secvisogram", "version": "2.5.25" } }, "id": "VDE-2022-055", "initial_release_date": "2023-02-16T13:43:00.000Z", "revision_history": [ { "date": "2023-02-16T13:43:00.000Z", "number": "1", "summary": "Initial revision." } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "name": "WAGO", "category": "vendor", "branches": [ { "name": "Hardware", "category": "product_family", "branches": [ { "name": "Unmanaged Switch", "category": "product_name", "product": { "name": "Unmanaged Switch", "product_id": "CSAFPID-11001", "product_identification_helper": { "model_numbers": [ "852-111/000-001" ] } } } ] }, { "name": "Firmware", "category": "product_family", "branches": [ { "name": "01", "category": "product_version", "product": { "name": "Firmware 01", "product_id": "CSAFPID-21001" } } ] } ] } ], "relationships": [ { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11001", "category": "installed_on", "full_product_name": { "name": "Firmware 01 installed on Unmanaged Switch", "product_id": "CSAFPID-31001" } } ] }, "vulnerabilities": [ { "cve": "CVE-2022-3843", "cwe": { "id": "CWE-912", "name": "Hidden Functionality" }, "notes": [ { "category": "description", "text": "In WAGO Unmanaged Switch (852-111/000-001) in firmware version 01 an undocumented configuration interface without authorization allows an remote attacker to read system information and configure a limited set of parameters.\n", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001" ] }, "remediations": [ { "category": "mitigation", "details": "Restrict network access to the device.\nDo not directly connect the device to the internet", "product_ids": [ "CSAFPID-31001" ] }, { "category": "vendor_fix", "details": "A firmware update which fixes the problem is available. Users who want to do a firmware update should contact the WAGO support.", "product_ids": [ "CSAFPID-31001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.1, "environmentalSeverity": "CRITICAL", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.1, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001" ] } ], "title": "CVE-2022-3843" } ] } ``` ## [vde-2022-054](https://vulnerability.circl.lu/vuln/vde-2022-054) ```json { "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] }, { "organization": "ONEKEY Research Lab", "names": [ "Quentin Kaiser" ], "summary": "reporting" } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "A vulnerability in the web-based management (WBM) of WAGOs programmable logic controller (PLC) could allow an unauthenticated remote attacker to retrieve sensitive information.", "title": "Summary" }, { "category": "description", "text": "The vulnerability allows a remote, unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like credentials and cryptographic material. A valid user has to create a backup after the last reboot for this attack to be successfull.", "title": "Impact" }, { "category": "description", "text": "Install FW22 Patch 1", "title": "Remediation" } ], "publisher": { "contact_details": "psirt@wago.com", "name": "WAGO GmbH & Co. KG", "namespace": "https://www.wago.com/psirt", "category": "vendor" }, "references": [ { "category": "self", "summary": "VDE-2022-054: WAGO: Unauthenticated Configuration Export in web-based management in multiple devices - HTML", "url": "https://certvde.com/en/advisories/VDE-2022-054/" }, { "category": "self", "summary": "VDE-2022-054: WAGO: Unauthenticated Configuration Export in web-based management in multiple devices - CSAF", "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2023/vde-2022-054.json" }, { "category": "external", "summary": "WAGO PSIRT", "url": "https://www.wago.com/psirt" }, { "category": "external", "summary": "CERT@VDE Security Advisories for WAGO GmbH & Co. KG", "url": "https://certvde.com/en/advisories/vendor/wago/" } ], "title": "WAGO: Unauthenticated Configuration Export in web-based management in multiple devices", "tracking": { "aliases": [ "VDE-2022-054" ], "current_release_date": "2023-01-12T07:52:00.000Z", "generator": { "date": "2025-05-05T11:45:57.068Z", "engine": { "name": "Secvisogram", "version": "2.5.24" } }, "id": "VDE-2022-054", "initial_release_date": "2023-01-12T07:52:00.000Z", "revision_history": [ { "date": "2023-01-12T07:52:00.000Z", "number": "1", "summary": "Initial revision." } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "name": "WAGO", "category": "vendor", "branches": [ { "name": "Hardware", "category": "product_family", "branches": [ { "name": "Series WAGO PFC100", "category": "product_name", "product": { "name": "Series WAGO PFC100", "product_id": "CSAFPID-11001", "product_identification_helper": { "model_numbers": [ "750-81xx/xxx-xxx" ] } } }, { "name": "Series WAGO PFC200", "category": "product_name", "product": { "name": "Series WAGO PFC200", "product_id": "CSAFPID-11002", "product_identification_helper": { "model_numbers": [ "750-82xx/xxx-xxx" ] } } }, { "name": "Series WAGO Touch Panel 600 Advanced Line", "category": "product_name", "product": { "name": "Series WAGO Touch Panel 600 Advanced Line", "product_id": "CSAFPID-11003", "product_identification_helper": { "model_numbers": [ "762-5xxx" ] } } }, { "name": "Series WAGO Touch Panel 600 Marine Line", "category": "product_name", "product": { "name": "Series WAGO Touch Panel 600 Marine Line", "product_id": "CSAFPID-11004", "product_identification_helper": { "model_numbers": [ "762-6xxx" ] } } }, { "name": "Series WAGO Touch Panel 600 Standard Line", "category": "product_name", "product": { "name": "Series WAGO Touch Panel 600 Standard Line", "product_id": "CSAFPID-11005", "product_identification_helper": { "model_numbers": [ "762-4xxx" ] } } }, { "name": "WAGO Compact Controller CC100", "category": "product_name", "product": { "name": "WAGO Compact Controller CC100", "product_id": "CSAFPID-11006", "product_identification_helper": { "model_numbers": [ "751-9301" ] } } }, { "name": "WAGO Edge Controller", "category": "product_name", "product": { "name": "WAGO Edge Controller", "product_id": "CSAFPID-11007", "product_identification_helper": { "model_numbers": [ "752-8303/8000-002" ] } } } ] }, { "name": "Firmware", "category": "product_family", "branches": [ { "name": "FW16<=FW22", "category": "product_version_range", "product": { "name": "Firmware FW16 <= FW22", "product_id": "CSAFPID-21001" } }, { "name": "FW22 Patch 1", "category": "product_version", "product": { "name": "Firmware FW22 Patch 1", "product_id": "CSAFPID-22001" } } ] } ] } ], "product_groups": [ { "group_id": "CSAFGID-0001", "product_ids": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007" ], "summary": "Affected products." }, { "group_id": "CSAFGID-0002", "product_ids": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007" ], "summary": "Fixed products." } ], "relationships": [ { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11001", "category": "installed_on", "full_product_name": { "name": "Firmware FW16 <= FW22 installed on Series WAGO PFC100", "product_id": "CSAFPID-31001" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11002", "category": "installed_on", "full_product_name": { "name": "Firmware FW16 <= FW22 installed on Series WAGO PFC200", "product_id": "CSAFPID-31002" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11003", "category": "installed_on", "full_product_name": { "name": "Firmware FW16 <= FW22 installed on Series WAGO Touch Panel 600 Advanced Line", "product_id": "CSAFPID-31003" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11004", "category": "installed_on", "full_product_name": { "name": "Firmware FW16 <= FW22 installed on Series WAGO Touch Panel 600 Marine Line", "product_id": "CSAFPID-31004" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11005", "category": "installed_on", "full_product_name": { "name": "Firmware FW16 <= FW22 installed on Series WAGO Touch Panel 600 Standard Line", "product_id": "CSAFPID-31005" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11006", "category": "installed_on", "full_product_name": { "name": "Firmware FW16 <= FW22 installed on WAGO Compact Controller CC100", "product_id": "CSAFPID-31006" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11007", "category": "installed_on", "full_product_name": { "name": "Firmware FW16 <= FW22 installed on WAGO Edge Controller", "product_id": "CSAFPID-31007" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11001", "category": "installed_on", "full_product_name": { "name": "Firmware FW22 Patch 1 installed on Series WAGO PFC100", "product_id": "CSAFPID-32001" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11002", "category": "installed_on", "full_product_name": { "name": "Firmware FW22 Patch 1 installed on Series WAGO PFC200", "product_id": "CSAFPID-32002" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11003", "category": "installed_on", "full_product_name": { "name": "Firmware FW22 Patch 1 installed on Series WAGO Touch Panel 600 Advanced Line", "product_id": "CSAFPID-32003" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11004", "category": "installed_on", "full_product_name": { "name": "Firmware FW22 Patch 1 installed on Series WAGO Touch Panel 600 Marine Line", "product_id": "CSAFPID-32004" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11005", "category": "installed_on", "full_product_name": { "name": "Firmware FW22 Patch 1 installed on Series WAGO Touch Panel 600 Standard Line", "product_id": "CSAFPID-32005" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11006", "category": "installed_on", "full_product_name": { "name": "Firmware FW22 Patch 1 installed on WAGO Compact Controller CC100", "product_id": "CSAFPID-32006" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11007", "category": "installed_on", "full_product_name": { "name": "Firmware FW22 Patch 1 installed on WAGO Edge Controller", "product_id": "CSAFPID-32007" } } ] }, "vulnerabilities": [ { "cve": "CVE-2022-3738", "cwe": { "id": "CWE-306", "name": "Missing Authentication for Critical Function" }, "notes": [ { "category": "description", "text": "The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like credentials and cryptographic material. A valid user has to create a backup after the last reboot for this attack to be successfull.\n", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007" ] }, "remediations": [ { "category": "vendor_fix", "details": "Install FW22 Patch 1", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "environmentalScore": 5.9, "environmentalSeverity": "MEDIUM", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 5.9, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007" ] } ], "title": "CVE-2022-3738" } ] } ``` ## [vde-2022-042](https://vulnerability.circl.lu/vuln/vde-2022-042) ```json { "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "The MAC address filter as part of the firewall has a flaw, which prevents the MAC address filter to be active after restart. In this way a remote attacker is able to circumvent the MAC address filtering after a reboot of a device.", "title": "Summary" }, { "category": "description", "text": "Exploiting this flaw, an remote attacker is able to reach the network which should be protected by the MAC address filter.", "title": "Impact" }, { "category": "description", "text": "Reactivate MAC Address Filter after restart to make sure MAC Address Filter is working. To test if the MAC Address Filter is working just add a test-client to the MAC Address Filter list, enable it and check if you can access the web-based-management via the test-client.", "title": "Mitigation" }, { "category": "description", "text": "We recommend all effected users to update to the firmware version listed below:\n\n### **Serie WAGO PFC100/PFC200 and WAGO Compact Controller CC100**\n\n| Article Number | Fixed Firmware |\n|-----------------------|--------------------|\n| 750-81xx/xxx-xxx | 03.10.10(22) |\n| 750-8217/xxx-xxx | 03.10.10(22) |\n| 750-82xx/xxx-xxx | 03.10.10(22) |\n| 751-9301 | 04.01.10(23) |\n\n### **Serie WAGO Touch Panel 600 and WAGO Edge Controller**\n\n| Article Number | Fixed Firmware |\n|-----------------------|--------------------|\n| 762-4xxx | 03.10.10(22) |\n| 762-5xxx | 03.10.10(22) |\n| 762-6xxx | 03.10.10(22) |\n| 752-8303/8000-002 | 03.10.10(22) |", "title": "Remediation" } ], "publisher": { "contact_details": "psirt@wago.com", "name": "WAGO GmbH & Co. KG", "namespace": "https://www.wago.com/psirt", "category": "vendor" }, "references": [ { "category": "self", "summary": "VDE-2022-042: WAGO: Multiple products - Loss of MAC-Address-Filtering after reboot - HTML", "url": "https://certvde.com/en/advisories/VDE-2022-042/" }, { "category": "self", "summary": "VDE-2022-042: WAGO: Multiple products - Loss of MAC-Address-Filtering after reboot - CSAF", "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2022/vde-2022-042.json" }, { "category": "external", "summary": "Vendor PSIRT", "url": "https://www.wago.com/psirt" }, { "category": "external", "summary": "CERT@VDE Security Advisories for WAGO GmbH & Co. KG", "url": "https://certvde.com/en/advisories/vendor/wago/" } ], "title": "WAGO: Multiple products - Loss of MAC-Address-Filtering after reboot", "tracking": { "aliases": [ "VDE-2022-042" ], "current_release_date": "2022-10-17T08:00:00.000Z", "generator": { "date": "2025-06-12T12:02:31.927Z", "engine": { "name": "Secvisogram", "version": "2.5.27" } }, "id": "VDE-2022-042", "initial_release_date": "2022-10-17T08:00:00.000Z", "revision_history": [ { "date": "2022-10-17T08:00:00.000Z", "number": "1.0.0", "summary": "Initial revision." } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "name": "Vendor", "category": "vendor", "branches": [ { "name": "Hardware", "category": "product_family", "branches": [ { "name": "Series WAGO Touch Panel 600", "category": "product_name", "product": { "name": "Series WAGO Touch Panel 600", "product_id": "CSAFPID-11001", "product_identification_helper": { "model_numbers": [ "762-6xxx", "762-5xxx", "762-4xxx" ] } } }, { "name": "WAGO Compact Controller CC100", "category": "product_name", "product": { "name": "WAGO Compact Controller CC100", "product_id": "CSAFPID-11002", "product_identification_helper": { "model_numbers": [ "751-9301" ] } } }, { "name": "WAGO Edge Controller", "category": "product_name", "product": { "name": "WAGO Edge Controller", "product_id": "CSAFPID-11003", "product_identification_helper": { "model_numbers": [ "752-8303/8000-002" ] } } }, { "name": "750-81xx/xxx-xxx", "category": "product_name", "product": { "name": "750-81xx/xxx-xxx", "product_id": "CSAFPID-11004" } }, { "name": "750-8217/xxx-xxx", "category": "product_name", "product": { "name": "750-8217/xxx-xxx", "product_id": "CSAFPID-11005" } }, { "name": "750-82xx/xxx-xxx", "category": "product_name", "product": { "name": "750-82xx/xxx-xxx", "product_id": "CSAFPID-11006" } } ] }, { "name": "Firmware", "category": "product_family", "branches": [ { "name": "03.04.10(16)<=03.10.08(22)", "category": "product_version_range", "product": { "name": "Firmware 03.04.10(16)<=03.10.08(22)", "product_id": "CSAFPID-21001" } }, { "name": "03.01.07(13)<=03.10.08(22)", "category": "product_version_range", "product": { "name": "Firmware 03.01.07(13)<=03.10.08(22)", "product_id": "CSAFPID-21002" } }, { "name": "03.01.07(13)<=03.10.09(22)", "category": "product_version_range", "product": { "name": "Firmware 03.01.07(13)<=03.10.09(22)", "product_id": "CSAFPID-21003" } }, { "name": "03.07.17(19)<=03.09.08(21)", "category": "product_version_range", "product": { "name": "Firmware 03.07.17(19)<=03.09.08(21)", "product_id": "CSAFPID-21004" } }, { "name": "03.06.09(18)<=03.10.09(22)", "category": "product_version_range", "product": { "name": "Firmware 03.06.09(18)<=03.10.09(22)", "product_id": "CSAFPID-21005" } }, { "name": "03.10.10(22)", "category": "product_version", "product": { "name": "Firmware 03.10.10(22)", "product_id": "CSAFPID-22001" } }, { "name": " 04.01.10(23", "category": "product_version", "product": { "name": "Firmware 04.01.10(23", "product_id": "CSAFPID-22002" } } ] } ] } ], "product_groups": [ { "group_id": "CSAFGID-0001", "product_ids": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006" ], "summary": "Affected products." }, { "group_id": "CSAFGID-0002", "product_ids": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006" ], "summary": "Fixed products." } ], "relationships": [ { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11002", "category": "installed_on", "full_product_name": { "name": "Firmware 03.01.07(13)<=03.10.08(22) installed on WAGO Compact Controller CC100", "product_id": "CSAFPID-31001" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11003", "category": "installed_on", "full_product_name": { "name": "Firmware 03.01.07(13)<=03.10.08(22) installed on WAGO Compact Controller CC100", "product_id": "CSAFPID-31002" } }, { "product_reference": "CSAFPID-21003", "relates_to_product_reference": "CSAFPID-11004", "category": "installed_on", "full_product_name": { "name": "Firmware 03.01.07(13)<=03.10.09(22) installed on WAGO Edge Controller", "product_id": "CSAFPID-31003" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11002", "category": "installed_on", "full_product_name": { "name": "Firmware 03.10.10(22) installed on Series WAGO Touch Panel 600", "product_id": "CSAFPID-32001" } }, { "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11003", "category": "installed_on", "full_product_name": { "name": "Firmware 04.01.10(23 installed on WAGO Compact Controller CC100", "product_id": "CSAFPID-32002" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11004", "category": "installed_on", "full_product_name": { "name": "Firmware 03.10.10(22) installed on WAGO Edge Controller", "product_id": "CSAFPID-32003" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11004", "category": "installed_on", "full_product_name": { "name": "Firmware 03.01.07(13)<=03.10.08(22) installed on 750-81xx/xxx-xxx", "product_id": "CSAFPID-31004" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11005", "category": "installed_on", "full_product_name": { "name": "Firmware 03.04.10(16)<=03.10.08(22) installed on 750-8217/xxx-xxx", "product_id": "CSAFPID-31005" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11006", "category": "installed_on", "full_product_name": { "name": "Firmware 03.01.07(13)<=03.10.08(22) installed on 750-82xx/xxx-xxx", "product_id": "CSAFPID-31006" } }, { "relates_to_product_reference": "CSAFPID-11004", "product_reference": "CSAFPID-22001", "category": "installed_on", "full_product_name": { "name": "Firmware 03.10.10(22) installed on 750-81xx/xxx-xxx", "product_id": "CSAFPID-32004" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11005", "category": "installed_on", "full_product_name": { "name": "Firmware 03.10.10(22) installed on 750-8217/xxx-xxx", "product_id": "CSAFPID-32005" } }, { "relates_to_product_reference": "CSAFPID-11006", "product_reference": "CSAFPID-22001", "category": "installed_on", "full_product_name": { "name": "Firmware 03.10.10(22) installed on 750-82xx/xxx-xxx", "product_id": "CSAFPID-32006" } } ] }, "vulnerabilities": [ { "cve": "CVE-2022-3281", "cwe": { "id": "CWE-440", "name": "Expected Behavior Violation" }, "notes": [ { "category": "description", "text": "WAGO Series PFC100/PFC200, Series Touch Panel 600, Compact Controller CC100 and Edge Controller in multiple versions are prone to a loss of MAC-Address-Filtering after reboot. This may allow an remote attacker to circumvent the reach the network that should be protected by the MAC address filter.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004" ] }, "remediations": [ { "category": "mitigation", "details": "Reactivate MAC Address Filter after restart to make sure MAC Address Filter is working. To test if the MAC Address Filter is working just add a test-client to the MAC Address Filter list, enable it and check if you can access the web-based-management via the test-client.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "We recommend all effected users to update to the firmware version listed below:\n\n### **Serie WAGO PFC100/PFC200 and WAGO Compact Controller CC100**\n\n| Article Number | Fixed Firmware |\n|-----------------------|--------------------|\n| 750-81xx/xxx-xxx | 03.10.10(22) |\n| 750-8217/xxx-xxx | 03.10.10(22) |\n| 750-82xx/xxx-xxx | 03.10.10(22) |\n| 751-9301 | 04.01.10(23) |\n\n### **Serie WAGO Touch Panel 600 and WAGO Edge Controller**\n\n| Article Number | Fixed Firmware |\n|-----------------------|--------------------|\n| 762-4xxx | 03.10.10(22) |\n| 762-5xxx | 03.10.10(22) |\n| 762-6xxx | 03.10.10(22) |\n| 752-8303/8000-002 | 03.10.10(22) |", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 7.5, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004" ] } ], "title": "CVE-2022-3281" } ] } ``` ## [vde-2022-047](https://vulnerability.circl.lu/vuln/vde-2022-047) ```json { "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] }, { "organization": "Kaspersky", "summary": "reporting", "names": [ "Roman Ezhov" ] } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "The FTP server does not properly release memory resources that were reserved for incomplete connection attempts by FTP clients. This could allow a remote attacker to generate a denial of service condition on devices that incorporate a vulnerable version of the FTP server.See also: Siemens Advisory published October 11th, 2022 - SSA-313313", "title": "Summary" }, { "category": "description", "text": "Abusing this vulnerability an attacker can crash an affected product, which fully prevents the product to work as intended. After a complete restart the component works as expected.", "title": "Impact" }, { "category": "description", "text": "If you enabled the FTP-Server, but you do not need FTP data transfer, you can deactivate the FTP Server over the product settings in the web-based management.\n\nAs general security measures strongly WAGO recommends:\n\n1. Use general security best practices to protect systems from local and network attacks.\n\n2. Do not allow direct access to the device from untrusted networks.\n\n3. Update to the latest firmware according to the table in chapter solutions.\n\n4. Industrial control systems (ICS) should not be directly accessible from the Internet, but should be protected by consistently applying the defense-in-depth strategy.\nThe BSI provides general information on securing ICS in the ICS Compendium (https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/ICS/ICS-Security_compendium.pdf external link).", "title": "Mitigation" }, { "category": "description", "text": "Wago recommends all effected users to update to the firmware version listed below:\n\n### Series WAGO 750-3x / -8x\n\n| Article Number | Fixed Version |\n|-----------------------|----------------------------------|\n| 750-330 | Beta FW17 Q1/2023 |\n| 750-332 | FW11 after BACnet certification |\n| 750-352/xxx-xxx | FW17 Q1/2023 |\n| 750-362/xxx-xxx | FW11 Q1/2023 |\n| 750-363/xxx-xxx | FW11 Q1/2023 |\n| 750-364/xxx-xxx | FW11 Q1/2023 |\n| 750-365/xxx-xxx | FW11 Q1/2023 |\n| 750-823 | FW11 Q1/2023 |\n| 750-829 | Beta FW17 Q1/2023 |\n| 750-831/xxx-xxx | Beta FW17 Q1/2023 |\n| 750-832/xxx-xxx | FW11 after BACnet certification |\n| 750-852 | FW17 Q1/2023 |\n| 750-862 | FW11 Q1/2023 |\n| 750-880/xxx-xxx | FW17 Q1/2023 |\n| 750-881 | FW17 Q1/2023 |\n| 750-882 | FW17 Q1/2023 |\n| 750-885/xxx-xxx | FW17 Q1/2023 |\n| 750-889 | FW17 Q1/2023 |\n| 750-890/xxx-xxx | FW11 Q1/2023 |\n| 750-891 | FW11 Q1/2023 |\n| 750-893 | FW11 Q1/2023 |", "title": "Remediation" } ], "publisher": { "contact_details": "psirt@wago.com", "name": "WAGO GmbH & Co. KG", "namespace": "https://www.wago.com/psirt", "category": "vendor" }, "references": [ { "category": "self", "summary": "VDE-2022-047: WAGO: FTP-Server - Denial-of-Service - HTML", "url": "https://certvde.com/en/advisories/VDE-2022-047/" }, { "category": "self", "summary": "VDE-2022-047: WAGO: FTP-Server - Denial-of-Service - CSAF", "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2022/vde-2022-047.json" }, { "category": "external", "summary": "Vendor PSIRT", "url": "https://www.wago.com/psirt" }, { "category": "external", "summary": "CERT@VDE Security Advisories for WAGO GmbH & Co. KG", "url": "https://certvde.com/en/advisories/vendor/wago/" } ], "title": "WAGO: FTP-Server - Denial-of-Service", "tracking": { "aliases": [ "VDE-2022-047" ], "current_release_date": "2022-10-12T08:00:00.000Z", "generator": { "date": "2025-04-30T08:57:32.237Z", "engine": { "name": "Secvisogram", "version": "2.5.24" } }, "id": "VDE-2022-047", "initial_release_date": "2022-10-12T08:00:00.000Z", "revision_history": [ { "date": "2022-10-12T08:00:00.000Z", "number": "1", "summary": "Initial revision." } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "name": "WAGO", "category": "vendor", "branches": [ { "name": "Hardware", "category": "product_family", "branches": [ { "name": "750-330", "category": "product_name", "product": { "name": "750-330", "product_id": "CSAFPID-11001", "product_identification_helper": { "model_numbers": [ "750-330" ] } } }, { "name": "750-332", "category": "product_name", "product": { "name": "750-332", "product_id": "CSAFPID-11002", "product_identification_helper": { "model_numbers": [ "750-332" ] } } }, { "name": "750-352/xxx-xxx", "category": "product_name", "product": { "name": "750-352/xxx-xxx", "product_id": "CSAFPID-11003", "product_identification_helper": { "model_numbers": [ "750-352/xxx-xxx" ] } } }, { "name": "750-362/xxx-xxx", "category": "product_name", "product": { "name": "750-362/xxx-xxx", "product_id": "CSAFPID-11004", "product_identification_helper": { "model_numbers": [ "750-362/xxx-xxx" ] } } }, { "name": "750-363/xxx-xxx", "category": "product_name", "product": { "name": "750-363/xxx-xxx", "product_id": "CSAFPID-11005", "product_identification_helper": { "model_numbers": [ "750-363/xxx-xxx" ] } } }, { "name": "750-364/xxx-xxx", "category": "product_name", "product": { "name": "750-364/xxx-xxx", "product_id": "CSAFPID-11006", "product_identification_helper": { "model_numbers": [ "750-364/xxx-xxx" ] } } }, { "name": "750-365/xxx-xxx", "category": "product_name", "product": { "name": "750-365/xxx-xxx", "product_id": "CSAFPID-11007", "product_identification_helper": { "model_numbers": [ "750-365/xxx-xxx" ] } } }, { "name": "750-823", "category": "product_name", "product": { "name": "750-823", "product_id": "CSAFPID-11008", "product_identification_helper": { "model_numbers": [ "750-823" ] } } }, { "name": "750-829", "category": "product_name", "product": { "name": "750-829", "product_id": "CSAFPID-11009", "product_identification_helper": { "model_numbers": [ "750-829" ] } } }, { "name": "750-831/xxx-xxx", "category": "product_name", "product": { "name": "750-831/xxx-xxx", "product_id": "CSAFPID-11010", "product_identification_helper": { "model_numbers": [ "750-831/xxx-xxx" ] } } }, { "name": "750-832/xxx-xxx", "category": "product_name", "product": { "name": "750-832/xxx-xxx", "product_id": "CSAFPID-11011", "product_identification_helper": { "model_numbers": [ "750-832/xxx-xxx" ] } } }, { "name": "750-852", "category": "product_name", "product": { "name": "750-852", "product_id": "CSAFPID-11012", "product_identification_helper": { "model_numbers": [ "750-852" ] } } }, { "name": "750-862", "category": "product_name", "product": { "name": "750-862", "product_id": "CSAFPID-11013", "product_identification_helper": { "model_numbers": [ "750-862" ] } } }, { "name": "750-880/xxx-xxx", "category": "product_name", "product": { "name": "750-880/xxx-xxx", "product_id": "CSAFPID-11014", "product_identification_helper": { "model_numbers": [ "750-880/xxx-xxx" ] } } }, { "name": "750-881", "category": "product_name", "product": { "name": "750-881", "product_id": "CSAFPID-11015", "product_identification_helper": { "model_numbers": [ "750-881" ] } } }, { "name": "750-882", "category": "product_name", "product": { "name": "750-882", "product_id": "CSAFPID-11016", "product_identification_helper": { "model_numbers": [ "750-882" ] } } }, { "name": "750-885/xxx-xxx", "category": "product_name", "product": { "name": "750-885/xxx-xxx", "product_id": "CSAFPID-11017", "product_identification_helper": { "model_numbers": [ "750-885/xxx-xxx" ] } } }, { "name": "750-889", "category": "product_name", "product": { "name": "750-889", "product_id": "CSAFPID-11018", "product_identification_helper": { "model_numbers": [ "750-889" ] } } }, { "name": "750-890/xxx-xxx", "category": "product_name", "product": { "name": "750-890/xxx-xxx", "product_id": "CSAFPID-11019", "product_identification_helper": { "model_numbers": [ "750-890/xxx-xxx" ] } } }, { "name": "750-891", "category": "product_name", "product": { "name": "750-891", "product_id": "CSAFPID-11020", "product_identification_helper": { "model_numbers": [ "750-891" ] } } }, { "name": "750-893", "category": "product_name", "product": { "name": "750-893", "product_id": "CSAFPID-11021", "product_identification_helper": { "model_numbers": [ "750-893" ] } } } ] }, { "name": "Firmware", "category": "product_family", "branches": [ { "name": "<=FW13", "category": "product_version_range", "product": { "name": "Firmware <=FW13", "product_id": "CSAFPID-21001" } }, { "name": "<=FW10", "category": "product_version_range", "product": { "name": "Firmware <=FW10", "product_id": "CSAFPID-21002" } }, { "name": "<=FW14", "category": "product_version_range", "product": { "name": "Firmware <=FW14", "product_id": "CSAFPID-21003" } }, { "name": "<=FW16", "category": "product_version_range", "product": { "name": "Firmware <=FW16", "product_id": "CSAFPID-21004" } }, { "name": "FW17", "category": "product_version", "product": { "name": "Firmware FW17", "product_id": "CSAFPID-22001" } }, { "name": "FW11", "category": "product_version", "product": { "name": "Firmware FW11", "product_id": "CSAFPID-22002" } } ] } ] } ], "product_groups": [ { "group_id": "CSAFGID-0001", "product_ids": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021" ], "summary": "Affected products." }, { "group_id": "CSAFGID-0002", "product_ids": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014", "CSAFPID-32015", "CSAFPID-32016", "CSAFPID-32017", "CSAFPID-32018", "CSAFPID-32019", "CSAFPID-32020", "CSAFPID-32021" ], "summary": "Fixed products." } ], "relationships": [ { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11001", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW13 installed on 750-330", "product_id": "CSAFPID-31001" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11002", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW10 installed on 750-332", "product_id": "CSAFPID-31002" } }, { "product_reference": "CSAFPID-21003", "relates_to_product_reference": "CSAFPID-11003", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW14 installed on 750-352/xxx-xxx", "product_id": "CSAFPID-31003" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11004", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW10 installed on 750-362/xxx-xxx", "product_id": "CSAFPID-31004" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11005", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW10 installed on 750-363/xxx-xxx", "product_id": "CSAFPID-31005" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11006", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW10 installed on 750-364/xxx-xxx", "product_id": "CSAFPID-31006" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11007", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW10 installed on 750-365/xxx-xxx", "product_id": "CSAFPID-31007" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11008", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW10 installed on 750-823", "product_id": "CSAFPID-31008" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11009", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW13 installed on 750-829", "product_id": "CSAFPID-31009" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11010", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW13 installed on 750-831/xxx-xxx", "product_id": "CSAFPID-31010" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11011", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW10 installed on 750-832/xxx-xxx", "product_id": "CSAFPID-31011" } }, { "product_reference": "CSAFPID-21004", "relates_to_product_reference": "CSAFPID-11012", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW16 installed on 750-852", "product_id": "CSAFPID-31012" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11013", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW10 installed on 750-862", "product_id": "CSAFPID-31013" } }, { "product_reference": "CSAFPID-21004", "relates_to_product_reference": "CSAFPID-11014", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW16 installed on 750-880/xxx-xxx", "product_id": "CSAFPID-31014" } }, { "product_reference": "CSAFPID-21004", "relates_to_product_reference": "CSAFPID-11015", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW16 installed on 750-881", "product_id": "CSAFPID-31015" } }, { "product_reference": "CSAFPID-21004", "relates_to_product_reference": "CSAFPID-11016", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW16 installed on 750-882", "product_id": "CSAFPID-31016" } }, { "product_reference": "CSAFPID-21004", "relates_to_product_reference": "CSAFPID-11017", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW16 installed on 750-885/xxx-xxx", "product_id": "CSAFPID-31017" } }, { "product_reference": "CSAFPID-21004", "relates_to_product_reference": "CSAFPID-11018", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW16 installed on 750-889", "product_id": "CSAFPID-31018" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11019", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW10 installed on 750-890/xxx-xxx", "product_id": "CSAFPID-31019" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11020", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW10 installed on 750-891", "product_id": "CSAFPID-31020" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11021", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW10 installed on 750-893", "product_id": "CSAFPID-31021" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11001", "category": "installed_on", "full_product_name": { "name": "Firmware FW17 installed on 750-330", "product_id": "CSAFPID-32001" } }, { "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11002", "category": "installed_on", "full_product_name": { "name": "Firmware FW11 installed on 750-332", "product_id": "CSAFPID-32002" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11003", "category": "installed_on", "full_product_name": { "name": "Firmware FW17 installed on 750-352/xxx-xxx", "product_id": "CSAFPID-32003" } }, { "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11004", "category": "installed_on", "full_product_name": { "name": "Firmware FW11 installed on 750-362/xxx-xxx", "product_id": "CSAFPID-32004" } }, { "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11005", "category": "installed_on", "full_product_name": { "name": "Firmware FW11 installed on 750-363/xxx-xxx", "product_id": "CSAFPID-32005" } }, { "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11006", "category": "installed_on", "full_product_name": { "name": "Firmware FW11 installed on 750-364/xxx-xxx", "product_id": "CSAFPID-32006" } }, { "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11007", "category": "installed_on", "full_product_name": { "name": "Firmware FW11 installed on 750-365/xxx-xxx", "product_id": "CSAFPID-32007" } }, { "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11008", "category": "installed_on", "full_product_name": { "name": "Firmware FW11 installed on 750-823", "product_id": "CSAFPID-32008" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11009", "category": "installed_on", "full_product_name": { "name": "Firmware FW17 installed on 750-829", "product_id": "CSAFPID-32009" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11010", "category": "installed_on", "full_product_name": { "name": "Firmware FW17 installed on 750-831/xxx-xxx", "product_id": "CSAFPID-32010" } }, { "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11011", "category": "installed_on", "full_product_name": { "name": "Firmware FW11 installed on 750-832/xxx-xxx", "product_id": "CSAFPID-32011" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11012", "category": "installed_on", "full_product_name": { "name": "Firmware FW17 installed on 750-852", "product_id": "CSAFPID-32012" } }, { "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11013", "category": "installed_on", "full_product_name": { "name": "Firmware FW11 installed on 750-862", "product_id": "CSAFPID-32013" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11014", "category": "installed_on", "full_product_name": { "name": "Firmware FW17 installed on 750-880/xxx-xxx", "product_id": "CSAFPID-32014" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11015", "category": "installed_on", "full_product_name": { "name": "Firmware FW17 installed on 750-881", "product_id": "CSAFPID-32015" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11016", "category": "installed_on", "full_product_name": { "name": "Firmware FW17 installed on 750-882", "product_id": "CSAFPID-32016" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11017", "category": "installed_on", "full_product_name": { "name": "Firmware FW17 installed on 750-885/xxx-xxx", "product_id": "CSAFPID-32017" } }, { "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11018", "category": "installed_on", "full_product_name": { "name": "Firmware FW17 installed on 750-889", "product_id": "CSAFPID-32018" } }, { "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11019", "category": "installed_on", "full_product_name": { "name": "Firmware FW11 installed on 750-890/xxx-xxx", "product_id": "CSAFPID-32019" } }, { "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11020", "category": "installed_on", "full_product_name": { "name": "Firmware FW11 installed on 750-891", "product_id": "CSAFPID-32020" } }, { "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11021", "category": "installed_on", "full_product_name": { "name": "Firmware FW11 installed on 750-893", "product_id": "CSAFPID-32021" } } ] }, "vulnerabilities": [ { "cve": "CVE-2022-38371", "title": "CVE-2022-38371", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "temporalScore": 7.5, "temporalSeverity": "HIGH", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021" ] } ], "notes": [ { "title": "Vulnerability Description", "text": "A vulnerability has been identified in Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions), Nucleus Source Code (Versions including affected FTP server). The FTP server does not properly release memory resources that were reserved for incomplete connection attempts by FTP clients. This could allow a remote attacker to generate a denial of service condition on devices that incorporate a vulnerable version of the FTP server.", "category": "description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014", "CSAFPID-32015", "CSAFPID-32016", "CSAFPID-32017", "CSAFPID-32018", "CSAFPID-32019", "CSAFPID-32020", "CSAFPID-32021" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021" ] }, "remediations": [ { "category": "mitigation", "details": "If you enabled the FTP-Server, but you do not need FTP data transfer, you can deactivate the FTP Server over the product settings in the web-based management.\n\nAs general security measures strongly WAGO recommends:\n\n1. Use general security best practices to protect systems from local and network attacks.\n\n2. Do not allow direct access to the device from untrusted networks.\n\n3. Update to the latest firmware according to the table in chapter solutions.\n\n4. Industrial control systems (ICS) should not be directly accessible from the Internet, but should be protected by consistently applying the defense-in-depth strategy.\nThe BSI provides general information on securing ICS in the ICS Compendium (https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/ICS/ICS-Security_compendium.pdf external link).", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "Wago recommends all effected users to update to the firmware version listed below:\n\n### Series WAGO 750-3x / -8x\n\n| Article Number | Fixed Version |\n|-----------------------|----------------------------------|\n| 750-330 | Beta FW17 Q1/2023 |\n| 750-332 | FW11 after BACnet certification |\n| 750-352/xxx-xxx | FW17 Q1/2023 |\n| 750-362/xxx-xxx | FW11 Q1/2023 |\n| 750-363/xxx-xxx | FW11 Q1/2023 |\n| 750-364/xxx-xxx | FW11 Q1/2023 |\n| 750-365/xxx-xxx | FW11 Q1/2023 |\n| 750-823 | FW11 Q1/2023 |\n| 750-829 | Beta FW17 Q1/2023 |\n| 750-831/xxx-xxx | Beta FW17 Q1/2023 |\n| 750-832/xxx-xxx | FW11 after BACnet certification |\n| 750-852 | FW17 Q1/2023 |\n| 750-862 | FW11 Q1/2023 |\n| 750-880/xxx-xxx | FW17 Q1/2023 |\n| 750-881 | FW17 Q1/2023 |\n| 750-882 | FW17 Q1/2023 |\n| 750-885/xxx-xxx | FW17 Q1/2023 |\n| 750-889 | FW17 Q1/2023 |\n| 750-890/xxx-xxx | FW11 Q1/2023 |\n| 750-891 | FW11 Q1/2023 |\n| 750-893 | FW11 Q1/2023 |", "group_ids": [ "CSAFGID-0001" ] } ] } ] } ``` ## [vde-2022-035](https://vulnerability.circl.lu/vuln/vde-2022-035) ```json { "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "Multiple WAGO product families are prone to multiple vulnerabilities affecting CODESYS control runtime system.", "title": "Summary" }, { "category": "description", "text": "Please consult the CVE entries for further information.", "title": "Impact" }, { "category": "description", "text": "• We recommend all effected users of the PFC 100 & PFC 200 product family to update to firmware version 03.10.08(22) or later.\n\n• We recommend all effected users of the TP600 and CC100 product family to update to firmware version 03.10.09(22) or later. \n\n• The affected products of the CC100 family will receive a patched Version approximately in 09/22.\n\nIn addition to the mitigation hints concerning the above-mentioned vulnerabilities CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits:\n\n- Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside\n- Use firewalls to protect and separate the control system network from other networks\n- Use VPN (Virtual Private Networks) tunnels if remote access is required\n- Activate and apply user management and password features\n- Use encrypted communication links\n- Limit the access to both development and control system by physical means, operating system features, etc.\n- Protect both development and control system by using up to date virus detecting solutions\n\nFor further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html", "title": "Mitigation" } ], "publisher": { "contact_details": "psirt@wago.com", "name": "WAGO GmbH & Co. KG", "namespace": "https://www.wago.com/psirt", "category": "vendor" }, "references": [ { "category": "self", "summary": "VDE-2022-035: WAGO: Multiple product series affected by multiple CODESYS vulnerabilities - HTML", "url": "https://certvde.com/en/advisories/VDE-2022-035/" }, { "category": "self", "summary": "VDE-2022-035: WAGO: Multiple product series affected by multiple CODESYS vulnerabilities - CSAF", "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2022/vde-2022-035.json" }, { "category": "external", "summary": "Vendor PSIRT", "url": "https://www.wago.com/psirt" }, { "category": "external", "summary": "CERT@VDE Security Advisories for WAGO GmbH & Co. KG", "url": "https://certvde.com/en/advisories/vendor/wago/" } ], "title": "WAGO: Multiple product series affected by multiple CODESYS vulnerabilities", "tracking": { "aliases": [ "VDE-2022-035" ], "current_release_date": "2022-08-17T08:00:00.000Z", "generator": { "date": "2025-05-26T08:33:34.917Z", "engine": { "name": "Secvisogram", "version": "2.5.26" } }, "id": "VDE-2022-035", "initial_release_date": "2022-08-17T08:00:00.000Z", "revision_history": [ { "date": "2022-08-17T08:00:00.000Z", "number": "1", "summary": "Initial revision." } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "name": "WAGO", "category": "vendor", "branches": [ { "name": "Hardware", "category": "product_family", "branches": [ { "name": "CC100", "category": "product_name", "product": { "name": "CC100", "product_id": "CSAFPID-11001", "product_identification_helper": { "model_numbers": [ "751-9301" ] } } }, { "name": "EC300", "category": "product_name", "product": { "name": "EC300", "product_id": "CSAFPID-11002", "product_identification_helper": { "model_numbers": [ "752-8303/8000-0002" ] } } }, { "name": "PFC 100", "category": "product_name", "product": { "name": "PFC 100", "product_id": "CSAFPID-11003", "product_identification_helper": { "model_numbers": [ "750-8102/xxx-xxx", "750-8100/xxx-xxx", "750-8101/xxx-xxx" ] } } }, { "name": "PFC 200", "category": "product_name", "product": { "name": "PFC 200", "product_id": "CSAFPID-11004", "product_identification_helper": { "model_numbers": [ "750-8202/xxx-xxx", "750-8206/xxx-xxx", "750-8207/xxx-xxx", "750-8210/xxx-xxx", "750-8211/xxx-xxx", "750-8212/xxx-xxx", "750-8213/xxx-xxx", "750-8214/xxx-xxx", "750-8215/xxx-xxx", "750-8216/xxx-xxx", "750-8203/xxx-xxx", "750-8204/xxx-xxx" ] } } }, { "name": "TP600", "category": "product_name", "product": { "name": "TP600", "product_id": "CSAFPID-11005", "product_identification_helper": { "model_numbers": [ "762-6x0x/8000-000x", "762-4x0x/8000-000x", "762-5x0x/8000-000x" ] } } } ] }, { "name": "Firmware", "category": "product_family", "branches": [ { "name": "<=03.09.07(21)", "category": "product_version_range", "product": { "name": "Firmware <=03.09.07(21)", "product_id": "CSAFPID-21001" } }, { "name": "<=03.07.14(19)", "category": "product_version_range", "product": { "name": "Firmware <=03.07.14(19)", "product_id": "CSAFPID-21002" } }, { "name": "<=03.09.05(21)", "category": "product_version_range", "product": { "name": "Firmware <=03.09.05(21)", "product_id": "CSAFPID-21003" } } ] } ] } ], "product_groups": [ { "group_id": "CSAFGID-0001", "product_ids": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005" ], "summary": "Affected products." } ], "relationships": [ { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11001", "category": "installed_on", "full_product_name": { "name": "Firmware <=03.09.07(21) installed on CC100", "product_id": "CSAFPID-31001" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11002", "category": "installed_on", "full_product_name": { "name": "Firmware <=03.07.14(19) installed on EC300", "product_id": "CSAFPID-31002" } }, { "product_reference": "CSAFPID-21003", "relates_to_product_reference": "CSAFPID-11003", "category": "installed_on", "full_product_name": { "name": "Firmware <=03.09.05(21) installed on PFC 100", "product_id": "CSAFPID-31003" } }, { "product_reference": "CSAFPID-21003", "relates_to_product_reference": "CSAFPID-11004", "category": "installed_on", "full_product_name": { "name": "Firmware <=03.09.05(21) installed on PFC 200", "product_id": "CSAFPID-31004" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11005", "category": "installed_on", "full_product_name": { "name": "Firmware <=03.07.14(19) installed on TP600", "product_id": "CSAFPID-31005" } } ] }, "vulnerabilities": [ { "cve": "CVE-2021-36763", "cwe": { "id": "CWE-552", "name": "Files or Directories Accessible to External Parties" }, "notes": [ { "category": "description", "text": "In CODESYS V3 web server before 3.5.17.10, files or directories are accessible to External Parties.", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005" ] }, "remediations": [ { "category": "mitigation", "details": "• We recommend all effected users of the PFC 100 & PFC 200 product family to update to firmware version 03.10.08(22) or later.\n\n• We recommend all effected users of the TP600 and CC100 product family to update to firmware version 03.10.09(22) or later. \n\n• The affected products of the CC100 family will receive a patched Version approximately in 09/22.\n\nIn addition to the mitigation hints concerning the above-mentioned vulnerabilities CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits:\n\n- Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside\n- Use firewalls to protect and separate the control system network from other networks\n- Use VPN (Virtual Private Networks) tunnels if remote access is required\n- Activate and apply user management and password features\n- Use encrypted communication links\n- Limit the access to both development and control system by physical means, operating system features, etc.\n- Protect both development and control system by using up to date virus detecting solutions\n\nFor further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 7.5, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005" ] } ], "title": "CVE-2021-36763" }, { "cve": "CVE-2021-33485", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "CODESYS Control Runtime system before 3.5.17.10 has a Heap-based Buffer Overflow.", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005" ] }, "remediations": [ { "category": "mitigation", "details": "• We recommend all effected users of the PFC 100 & PFC 200 product family to update to firmware version 03.10.08(22) or later.\n\n• We recommend all effected users of the TP600 and CC100 product family to update to firmware version 03.10.09(22) or later. \n\n• The affected products of the CC100 family will receive a patched Version approximately in 09/22.\n\nIn addition to the mitigation hints concerning the above-mentioned vulnerabilities CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits:\n\n- Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside\n- Use firewalls to protect and separate the control system network from other networks\n- Use VPN (Virtual Private Networks) tunnels if remote access is required\n- Activate and apply user management and password features\n- Use encrypted communication links\n- Limit the access to both development and control system by physical means, operating system features, etc.\n- Protect both development and control system by using up to date virus detecting solutions\n\nFor further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005" ] } ], "title": "CVE-2021-33485" }, { "cve": "CVE-2021-36765", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "description", "text": "In CODESYS EtherNetIP before 4.1.0.0, specific EtherNet/IP requests may cause a null pointer dereference in the downloaded vulnerable EtherNet/IP stack that is executed by the CODESYS Control runtime system.", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005" ] }, "remediations": [ { "category": "mitigation", "details": "• We recommend all effected users of the PFC 100 & PFC 200 product family to update to firmware version 03.10.08(22) or later.\n\n• We recommend all effected users of the TP600 and CC100 product family to update to firmware version 03.10.09(22) or later. \n\n• The affected products of the CC100 family will receive a patched Version approximately in 09/22.\n\nIn addition to the mitigation hints concerning the above-mentioned vulnerabilities CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits:\n\n- Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside\n- Use firewalls to protect and separate the control system network from other networks\n- Use VPN (Virtual Private Networks) tunnels if remote access is required\n- Activate and apply user management and password features\n- Use encrypted communication links\n- Limit the access to both development and control system by physical means, operating system features, etc.\n- Protect both development and control system by using up to date virus detecting solutions\n\nFor further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 7.5, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005" ] } ], "title": "CVE-2021-36765" }, { "cve": "CVE-2020-6081", "cwe": { "id": "CWE-345", "name": "Insufficient Verification of Data Authenticity" }, "notes": [ { "category": "description", "text": "An exploitable code execution vulnerability exists in the PLC_Task functionality of 3S-Smart Software Solutions GmbH CODESYS Runtime 3.5.14.30. A specially crafted network request can cause remote code execution. An attacker can send a malicious packet to trigger this vulnerability.", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005" ] }, "remediations": [ { "category": "mitigation", "details": "• We recommend all effected users of the PFC 100 & PFC 200 product family to update to firmware version 03.10.08(22) or later.\n\n• We recommend all effected users of the TP600 and CC100 product family to update to firmware version 03.10.09(22) or later. \n\n• The affected products of the CC100 family will receive a patched Version approximately in 09/22.\n\nIn addition to the mitigation hints concerning the above-mentioned vulnerabilities CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits:\n\n- Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside\n- Use firewalls to protect and separate the control system network from other networks\n- Use VPN (Virtual Private Networks) tunnels if remote access is required\n- Activate and apply user management and password features\n- Use encrypted communication links\n- Limit the access to both development and control system by physical means, operating system features, etc.\n- Protect both development and control system by using up to date virus detecting solutions\n\nFor further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 8.8, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 8.8, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005" ] } ], "title": "CVE-2020-6081" }, { "cve": "CVE-2021-29241", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "description", "text": "CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer dereference that may result in a denial of service (DoS).", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005" ] }, "remediations": [ { "category": "mitigation", "details": "• We recommend all effected users of the PFC 100 & PFC 200 product family to update to firmware version 03.10.08(22) or later.\n\n• We recommend all effected users of the TP600 and CC100 product family to update to firmware version 03.10.09(22) or later. \n\n• The affected products of the CC100 family will receive a patched Version approximately in 09/22.\n\nIn addition to the mitigation hints concerning the above-mentioned vulnerabilities CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits:\n\n- Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside\n- Use firewalls to protect and separate the control system network from other networks\n- Use VPN (Virtual Private Networks) tunnels if remote access is required\n- Activate and apply user management and password features\n- Use encrypted communication links\n- Limit the access to both development and control system by physical means, operating system features, etc.\n- Protect both development and control system by using up to date virus detecting solutions\n\nFor further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 7.5, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005" ] } ], "title": "CVE-2021-29241" }, { "cve": "CVE-2021-29242", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "description", "text": "CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Attackers can send crafted communication packets to change the router's addressing scheme and may re-route, add, remove or change low level communication packages.", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005" ] }, "remediations": [ { "category": "mitigation", "details": "• We recommend all effected users of the PFC 100 & PFC 200 product family to update to firmware version 03.10.08(22) or later.\n\n• We recommend all effected users of the TP600 and CC100 product family to update to firmware version 03.10.09(22) or later. \n\n• The affected products of the CC100 family will receive a patched Version approximately in 09/22.\n\nIn addition to the mitigation hints concerning the above-mentioned vulnerabilities CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits:\n\n- Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside\n- Use firewalls to protect and separate the control system network from other networks\n- Use VPN (Virtual Private Networks) tunnels if remote access is required\n- Activate and apply user management and password features\n- Use encrypted communication links\n- Limit the access to both development and control system by physical means, operating system features, etc.\n- Protect both development and control system by using up to date virus detecting solutions\n\nFor further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "environmentalScore": 7.3, "environmentalSeverity": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 7.3, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005" ] } ], "title": "CVE-2021-29242" } ] } ``` ## [vde-2022-031](https://vulnerability.circl.lu/vuln/vde-2022-031) ```json { "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "Multiple WAGO product families are prone to multiple vulnerabilities affecting CODESYS control runtime system.", "title": "Summary" }, { "category": "description", "text": "Please consult the CVE entries for further information.", "title": "Impact" }, { "category": "description", "text": "CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits:\n\n- Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside\n- Use firewalls to protect and separate the control system network from other networks\n- Use VPN (Virtual Private Networks) tunnels if remote access is required\n- Activate and apply user management and password features\n- Use encrypted communication links\n- Limit the access to both development and control system by physical means, operating system features, etc.\n- Protect both development and control system by using up to date virus detecting solutions\n \n\nFor further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html", "title": "Mitigation" } ], "publisher": { "contact_details": "psirt@wago.com", "name": "WAGO GmbH & Co. KG", "namespace": "https://www.wago.com/psirt", "category": "vendor" }, "references": [ { "category": "self", "summary": "VDE-2022-031: WAGO: Multiple Products Series affected by multiple CODESYS vulnerabilities - HTML", "url": "https://certvde.com/en/advisories/VDE-2022-031/" }, { "category": "self", "summary": "VDE-2022-031: WAGO: Multiple Products Series affected by multiple CODESYS vulnerabilities - CSAF", "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2022/vde-2022-031.json" }, { "category": "external", "summary": "Vendor PSIRT", "url": "https://www.wago.com/psirt" }, { "category": "external", "summary": "CERT@VDE Security Advisories for WAGO GmbH & Co. KG", "url": "https://certvde.com/en/advisories/vendor/wago/" } ], "title": "WAGO: Multiple Products Series affected by multiple CODESYS vulnerabilities", "tracking": { "aliases": [ "VDE-2022-031" ], "current_release_date": "2022-08-17T08:00:00.000Z", "generator": { "date": "2025-05-26T08:14:41.551Z", "engine": { "name": "Secvisogram", "version": "2.5.26" } }, "id": "VDE-2022-031", "initial_release_date": "2022-08-17T08:00:00.000Z", "revision_history": [ { "date": "2022-08-17T08:00:00.000Z", "number": "1", "summary": "Initial revision." } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "name": "WAGO", "category": "vendor", "branches": [ { "name": "Hardware", "category": "product_family", "branches": [ { "name": "EC300", "category": "product_name", "product": { "name": "EC300", "product_id": "CSAFPID-11001", "product_identification_helper": { "model_numbers": [ "752-8303/8000-0002" ] } } }, { "name": "PFC 100", "category": "product_name", "product": { "name": "PFC 100", "product_id": "CSAFPID-11002", "product_identification_helper": { "model_numbers": [ "750-8101/xxx-xxx", "750-8102/xxx-xxx", "750-8100/xxx-xxx" ] } } }, { "name": "PFC 200", "category": "product_name", "product": { "name": "PFC 200", "product_id": "CSAFPID-11003", "product_identification_helper": { "model_numbers": [ "750-8202/xxx-xxx", "750-8204/xxx-xxx", "750-8206/xxx-xxx", "750-8207/xxx-xxx", "750-8210/xxx-xxx", "750-8211/xxx-xxx", "750-8212/xxx-xxx", "750-8213/xxx-xxx", "750-8214/xxx-xxx", "750-8215/xxx-xxx", "750-8216/xxx-xxx", "750-8217/xxx-xxx", "750-8203/xxx-xxx" ] } } }, { "name": "TP600", "category": "product_name", "product": { "name": "TP600", "product_id": "CSAFPID-11004", "product_identification_helper": { "model_numbers": [ "762-5x0x/8000-000x", "762-6x0x/8000-000x", "762-4x0x/8000-000x" ] } } } ] }, { "name": "Firmware", "category": "product_family", "branches": [ { "name": "<=03.06.19(18)", "category": "product_version_range", "product": { "name": "Firmware <=03.06.19(18)", "product_id": "CSAFPID-21001" } } ] } ] } ], "product_groups": [ { "group_id": "CSAFGID-0001", "product_ids": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004" ], "summary": "Affected products." } ], "relationships": [ { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11001", "category": "installed_on", "full_product_name": { "name": "Firmware <=03.06.19(18) installed on EC300", "product_id": "CSAFPID-31001" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11002", "category": "installed_on", "full_product_name": { "name": "Firmware <=03.06.19(18) installed on PFC 100", "product_id": "CSAFPID-31002" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11003", "category": "installed_on", "full_product_name": { "name": "Firmware <=03.06.19(18) installed on PFC 200", "product_id": "CSAFPID-31003" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11004", "category": "installed_on", "full_product_name": { "name": "Firmware <=03.06.19(18) installed on TP600", "product_id": "CSAFPID-31004" } } ] }, "vulnerabilities": [ { "cve": "CVE-2019-9011", "cwe": { "id": "CWE-668", "name": "Exposure of Resource to Wrong Sphere" }, "notes": [ { "category": "description", "text": "In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), an attacker can identify valid usernames.", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004" ] }, "remediations": [ { "category": "mitigation", "details": "CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits:\n\n- Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside\n- Use firewalls to protect and separate the control system network from other networks\n- Use VPN (Virtual Private Networks) tunnels if remote access is required\n- Activate and apply user management and password features\n- Use encrypted communication links\n- Limit the access to both development and control system by physical means, operating system features, etc.\n- Protect both development and control system by using up to date virus detecting solutions\n \n\nFor further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "environmentalScore": 5.3, "environmentalSeverity": "MEDIUM", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 5.3, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004" ] } ], "title": "CVE-2019-9011" }, { "cve": "CVE-2019-9013", "cwe": { "id": "CWE-327", "name": "Use of a Broken or Risky Cryptographic Algorithm" }, "notes": [ { "category": "description", "text": "An issue was discovered in 3S-Smart CODESYS V3 products. The application may utilize non-TLS based encryption, which results in user credentials being insufficiently protected during transport. All variants of the following CODESYS V3 products in all versions containing the CmpUserMgr component are affected regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control RTE V3, CODESYS Control RTE V3 (for Beckhoff CX), CODESYS Control Win V3 (also part of the CODESYS Development System setup), CODESYS V3 Simulation Runtime (part of the CODESYS Development System), CODESYS Control V3 Runtime System Toolkit, CODESYS HMI V3.", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004" ] }, "remediations": [ { "category": "mitigation", "details": "CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits:\n\n- Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside\n- Use firewalls to protect and separate the control system network from other networks\n- Use VPN (Virtual Private Networks) tunnels if remote access is required\n- Activate and apply user management and password features\n- Use encrypted communication links\n- Limit the access to both development and control system by physical means, operating system features, etc.\n- Protect both development and control system by using up to date virus detecting solutions\n \n\nFor further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 8.8, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 8.8, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004" ] } ], "title": "CVE-2019-9013" }, { "cve": "CVE-2020-12067", "cwe": { "id": "CWE-640", "name": "Weak Password Recovery Mechanism for Forgotten Password" }, "notes": [ { "category": "description", "text": "In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), a user's password may be changed by an attacker without knowledge of the current password.", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004" ] }, "remediations": [ { "category": "mitigation", "details": "CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits:\n\n- Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside\n- Use firewalls to protect and separate the control system network from other networks\n- Use VPN (Virtual Private Networks) tunnels if remote access is required\n- Activate and apply user management and password features\n- Use encrypted communication links\n- Limit the access to both development and control system by physical means, operating system features, etc.\n- Protect both development and control system by using up to date virus detecting solutions\n \n\nFor further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 7.5, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004" ] } ], "title": "CVE-2020-12067" }, { "cve": "CVE-2020-12069", "cwe": { "id": "CWE-916", "name": "Use of Password Hash With Insufficient Computational Effort" }, "notes": [ { "category": "description", "text": "In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device.", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004" ] }, "remediations": [ { "category": "mitigation", "details": "CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits:\n\n- Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside\n- Use firewalls to protect and separate the control system network from other networks\n- Use VPN (Virtual Private Networks) tunnels if remote access is required\n- Activate and apply user management and password features\n- Use encrypted communication links\n- Limit the access to both development and control system by physical means, operating system features, etc.\n- Protect both development and control system by using up to date virus detecting solutions\n \n\nFor further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 7.8, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 7.8, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004" ] } ], "title": "CVE-2020-12069" } ] } ``` ## [vde-2022-004](https://vulnerability.circl.lu/vuln/vde-2022-004) ```json { "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "The Web-Based Management (WBM) of WAGOs programmable logic controller (PLC) is typically used for administration, commissioning and updates.Various configuration pages of the device are vulnerable to reflected XSS (Cross-Site Scripting) attacks.", "title": "Summary" }, { "category": "description", "text": "An attacker needs an authorized login on the device in order to exploit the various configuration pages with malicious scripts. This can be used to install malicious code and to gain access to confidential information on a PC that connects to the WBM after it has been compromised.", "title": "Impact" }, { "category": "description", "text": "Restrict network access to the device\nUse strong passwords\nDo not directly connect the device to the internet\nDisable unused TCP/UDP-ports\n\nPlease install upcoming FW-Update, which will be available at end of Q2/2022.", "title": "Mitigation" } ], "publisher": { "contact_details": "psirt@wago.com", "name": "WAGO GmbH & Co. KG", "namespace": "https://www.wago.com/psirt", "category": "vendor" }, "references": [ { "category": "self", "summary": "VDE-2022-004: WAGO: Web-Based Management Cross-Site Scripting - HTML", "url": "https://certvde.com/en/advisories/VDE-2022-004/" }, { "category": "self", "summary": "VDE-2022-004: WAGO: Web-Based Management Cross-Site Scripting - CSAF", "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2022/vde-2022-004.json" }, { "category": "external", "summary": "WAGO PSIRT", "url": "https://www.wago.com/de-en/automation-technology/psirt" }, { "category": "external", "summary": "CERT@VDE Security Advisories for WAGO GmbH & Co. KG", "url": "https://certvde.com/en/advisories/vendor/wago/" } ], "title": "WAGO: Web-Based Management Cross-Site Scripting", "tracking": { "aliases": [ "VDE-2022-004" ], "current_release_date": "2022-03-09T07:00:00.000Z", "generator": { "date": "2025-05-05T09:39:23.950Z", "engine": { "name": "Secvisogram", "version": "2.5.24" } }, "id": "VDE-2022-004", "initial_release_date": "2022-03-09T07:00:00.000Z", "revision_history": [ { "date": "2022-03-09T07:00:00.000Z", "number": "1", "summary": "Initial revision." } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "name": "WAGO", "category": "vendor", "branches": [ { "name": "Hardware", "category": "product_family", "branches": [ { "name": "Compact Controller 100", "category": "product_name", "product": { "name": "Compact Controller 100", "product_id": "CSAFPID-11001", "product_identification_helper": { "model_numbers": [ "751-9301" ] } } }, { "name": "Edge Controller", "category": "product_name", "product": { "name": "Edge Controller", "product_id": "CSAFPID-11002", "product_identification_helper": { "model_numbers": [ "752-8303/8000-002" ] } } }, { "name": "Series PFC100", "category": "product_name", "product": { "name": "Series PFC100", "product_id": "CSAFPID-11003", "product_identification_helper": { "model_numbers": [ "750-81xx/xxx-xxx" ] } } }, { "name": "Series PFC200", "category": "product_name", "product": { "name": "Series PFC200", "product_id": "CSAFPID-11004", "product_identification_helper": { "model_numbers": [ "750-82xx/xxx-xxx" ] } } }, { "name": "Series Touch Panel 600 Advanced Line", "category": "product_name", "product": { "name": "Series Touch Panel 600 Advanced Line", "product_id": "CSAFPID-11005", "product_identification_helper": { "model_numbers": [ "762-5xxx" ] } } }, { "name": "Series Touch Panel 600 Marine Line", "category": "product_name", "product": { "name": "Series Touch Panel 600 Marine Line", "product_id": "CSAFPID-11006", "product_identification_helper": { "model_numbers": [ "762-6xxx" ] } } }, { "name": "Series Touch Panel 600 Standard Line", "category": "product_name", "product": { "name": "Series Touch Panel 600 Standard Line", "product_id": "CSAFPID-11007", "product_identification_helper": { "model_numbers": [ "762-4xxx" ] } } } ] }, { "name": "Firmware", "category": "product_family", "branches": [ { "name": "FW16=FW10 | January 2022 |\n| 750-832/000-00x | >=FW10 | After BACnet certification|\n| 750-862 | >=FW10 | January 2022 |\n| 750-890/xxx-xxx | >=FW10 | January 2022 |\n| 750-891 | >=FW10 | January 2022 |\n| 750-893 | >=FW10 | January 2022 |\n| 750-332 | >=FW10 | After BACnet certification|\n| 750-362/xxx-xxx | >=FW10 | January 2022 |\n| 750-363/xxx-xxx | >=FW10 | January 2022 |\n| 750-364/xxx-xxx | >=FW10 | January 2022 |\n| 750-365/xxx-xxx | >=FW10 | January 2022 |", "title": "Remediation" } ], "publisher": { "contact_details": "psirt@wago.com", "name": "WAGO GmbH & Co. KG", "namespace": "https://www.wago.com/psirt", "category": "vendor" }, "references": [ { "category": "self", "summary": "VDE-2021-050: WAGO: Multiple devices affected by Vulnerabilities in NUCLEUS TCP Stack. - HTML", "url": "https://certvde.com/en/advisories/VDE-2021-050/" }, { "category": "self", "summary": "VDE-2021-050: WAGO: Multiple devices affected by Vulnerabilities in NUCLEUS TCP Stack. - CSAF", "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2021/vde-2021-050.json" }, { "category": "external", "summary": "WAGO PSIRT", "url": "https://www.wago.com/psirt" }, { "category": "external", "summary": "CERT@VDE Security Advisories for WAGO GmbH & Co. KG", "url": "https://certvde.com/en/advisories/vendor/wago/" } ], "title": "WAGO: Multiple devices affected by Vulnerabilities in NUCLEUS TCP Stack.", "tracking": { "aliases": [ "VDE-2021-050" ], "current_release_date": "2021-11-16T11:02:00.000Z", "generator": { "date": "2025-06-16T07:25:47.768Z", "engine": { "name": "Secvisogram", "version": "2.5.27" } }, "id": "VDE-2021-050", "initial_release_date": "2021-11-16T11:02:00.000Z", "revision_history": [ { "date": "2021-11-16T11:02:00.000Z", "number": "1.0.0", "summary": "Initial revision." } ], "status": "final", "version": "1.0.0" }, "aggregate_severity": { "namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale", "text": "Critical" } }, "product_tree": { "branches": [ { "name": "WAGO", "category": "vendor", "branches": [ { "name": "Hardware", "category": "product_family", "branches": [ { "name": "750-331", "category": "product_name", "product": { "name": "750-331", "product_id": "CSAFPID-11001" } }, { "name": "750-332", "category": "product_name", "product": { "name": "750-332", "product_id": "CSAFPID-11002" } }, { "name": "750-352/xxx-xxx", "category": "product_name", "product": { "name": "750-352/xxx-xxx", "product_id": "CSAFPID-11003" } }, { "name": "750-362/xxx-xxx", "category": "product_name", "product": { "name": "750-362/xxx-xxx", "product_id": "CSAFPID-11004" } }, { "name": "750-363/xxx-xxx", "category": "product_name", "product": { "name": "750-363/xxx-xxx", "product_id": "CSAFPID-11005" } }, { "name": "750-364/xxx-xxx", "category": "product_name", "product": { "name": "750-364/xxx-xxx", "product_id": "CSAFPID-11006" } }, { "name": "750-365/xxx-xxx", "category": "product_name", "product": { "name": "750-365/xxx-xxx", "product_id": "CSAFPID-11007" } }, { "name": "750-823", "category": "product_name", "product": { "name": "750-823", "product_id": "CSAFPID-11008" } }, { "name": "750-829", "category": "product_name", "product": { "name": "750-829", "product_id": "CSAFPID-11009" } }, { "name": "750-831/000-00x", "category": "product_name", "product": { "name": "750-831/000-00x", "product_id": "CSAFPID-11010" } }, { "name": "750-832/000-00x", "category": "product_name", "product": { "name": "750-832/000-00x", "product_id": "CSAFPID-11011" } }, { "name": "750-852", "category": "product_name", "product": { "name": "750-852", "product_id": "CSAFPID-11012" } }, { "name": "750-862", "category": "product_name", "product": { "name": "750-862", "product_id": "CSAFPID-11013" } }, { "name": "750-880/0xx-xxx", "category": "product_name", "product": { "name": "750-880/0xx-xxx", "product_id": "CSAFPID-11014" } }, { "name": "750-881", "category": "product_name", "product": { "name": "750-881", "product_id": "CSAFPID-11015" } }, { "name": "750-882", "category": "product_name", "product": { "name": "750-882", "product_id": "CSAFPID-11016" } }, { "name": "750-885/0xx-xxx", "category": "product_name", "product": { "name": "750-885/0xx-xxx", "product_id": "CSAFPID-11017" } }, { "name": "750-889", "category": "product_name", "product": { "name": "750-889", "product_id": "CSAFPID-11018" } }, { "name": "750-890/0xx-xxx", "category": "product_name", "product": { "name": "750-890/0xx-xxx", "product_id": "CSAFPID-11019" } }, { "name": "750-891", "category": "product_name", "product": { "name": "750-891", "product_id": "CSAFPID-11020" } }, { "name": "750-893", "category": "product_name", "product": { "name": "750-893", "product_id": "CSAFPID-11021" } } ] }, { "name": "Firmware", "category": "product_family", "branches": [ { "name": "<=FW16", "category": "product_version_range", "product": { "name": "Firmware <=FW16", "product_id": "CSAFPID-21001" } }, { "name": "<=FW09", "category": "product_version_range", "product": { "name": "Firmware <=FW09", "product_id": "CSAFPID-21002" } }, { "name": "<=FW14", "category": "product_version_range", "product": { "name": "Firmware <=FW14", "product_id": "CSAFPID-21003" } } ] } ] } ], "product_groups": [ { "group_id": "CSAFGID-0001", "product_ids": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021" ], "summary": "Affected products." } ], "relationships": [ { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11001", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW16 installed on 750-331", "product_id": "CSAFPID-31001" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11002", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW09 installed on 750-332", "product_id": "CSAFPID-31002" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11003", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW16 installed on 750-352/xxx-xxx", "product_id": "CSAFPID-31003" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11004", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW09 installed on 750-362/xxx-xxx", "product_id": "CSAFPID-31004" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11005", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW09 installed on 750-363/xxx-xxx", "product_id": "CSAFPID-31005" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11006", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW09 installed on 750-364/xxx-xxx", "product_id": "CSAFPID-31006" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11007", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW09 installed on 750-365/xxx-xxx", "product_id": "CSAFPID-31007" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11008", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW09 installed on 750-823", "product_id": "CSAFPID-31008" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11009", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW16 installed on 750-829", "product_id": "CSAFPID-31009" } }, { "product_reference": "CSAFPID-21003", "relates_to_product_reference": "CSAFPID-11010", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW14 installed on 750-831/000-00x", "product_id": "CSAFPID-31010" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11011", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW09 installed on 750-832/000-00x", "product_id": "CSAFPID-31011" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11012", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW16 installed on 750-852", "product_id": "CSAFPID-31012" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11013", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW09 installed on 750-862", "product_id": "CSAFPID-31013" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11014", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW16 installed on 750-880/0xx-xxx", "product_id": "CSAFPID-31014" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11015", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW16 installed on 750-881", "product_id": "CSAFPID-31015" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11016", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW16 installed on 750-882", "product_id": "CSAFPID-31016" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11017", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW16 installed on 750-885/0xx-xxx", "product_id": "CSAFPID-31017" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11018", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW16 installed on 750-889", "product_id": "CSAFPID-31018" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11019", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW09 installed on 750-890/0xx-xxx", "product_id": "CSAFPID-31019" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11020", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW09 installed on 750-891", "product_id": "CSAFPID-31020" } }, { "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11021", "category": "installed_on", "full_product_name": { "name": "Firmware <=FW09 installed on 750-893", "product_id": "CSAFPID-31021" } } ] }, "vulnerabilities": [ { "cve": "CVE-2021-31344", "cwe": { "id": "CWE-843", "name": "Access of Resource Using Incompatible Type ('Type Confusion')" }, "notes": [ { "category": "description", "text": "A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), SIMOTICS CONNECT 400 (All versions < V1.0.0.0). ICMP echo packets with fake IP options allow sending ICMP echo reply messages to arbitrary hosts on the network. (FSMD-2021-0004)", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021" ] }, "remediations": [ { "category": "mitigation", "details": "1. Use general security best practices to protect systems from local and network attacks.\n2. Do not allow direct access to the device from untrusted networks.\n3. Update to the latest firmware according to the table in chapter solutions.\n4. Disable the DHCP, DNS and the FTP port 21.\n5. Industrial control systems (ICS) should not be directly accessible from the Internet, but should be protected by consistently applying the defense-in-depth strategy. The BSI provides general information on securing ICS in the ICS Compendium [BSI2013] and on the official BSI website [BSI2021].\n\nFor fieldbus coupler:\n\n- 750-331\n- 750-352/xxx-xxx\n\nFor PLCs:\n\n- 750-829\n- 750-831/xxx-xxx\n- 750-852\n- 750-880/xxx-xxx\n- 750-881\n- 750-889\n\nThe listed fieldbus coupler and PLCs above are based on Nucleus V1 RTOS. At the moment there are no updates for this version available. Due to this reason WAGO recommends according to the recommendations of the BSI to implement the following measures:\n\n1. Enforce segmentation controls and proper network hygiene to reduce the risk of vulnerable devices. Restrict external communication paths and isolate vulnerable devices in zones as a mitigating measure.\n2. Ensure DHCP responses from non-authorized servers are blocked or discarded.\n3. Monitor network traffic for anomalies and discard invalid packets.\n4. Disable or block FTP, DHCP, DNS especially on critical network segments\n5. Please check regularly https://certvde.com/de/ for an update of this Advisory.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "For fieldbus coupler:\n\n- 750-332\n- 750-362/xxx-xxx\n- 750-363/xxx-xxx\n- 750-364/xxx-xxx\n- 750-365/xxx-xxx\n\nFor PLCs:\n\n- 750-823\n- 750-832/xxx-xxx\n- 750-862\n- 750-890/xxx-xxx\n- 750-891\n- 750-893\n\nWe recommend all effected users to update to the firmware version listed below:\n\n| Article Number | Fixed in Firmware Version | Availability |\n|----------------------|----------------------------|---------------------------|\n| 750-823 | >=FW10 | January 2022 |\n| 750-832/000-00x | >=FW10 | After BACnet certification|\n| 750-862 | >=FW10 | January 2022 |\n| 750-890/xxx-xxx | >=FW10 | January 2022 |\n| 750-891 | >=FW10 | January 2022 |\n| 750-893 | >=FW10 | January 2022 |\n| 750-332 | >=FW10 | After BACnet certification|\n| 750-362/xxx-xxx | >=FW10 | January 2022 |\n| 750-363/xxx-xxx | >=FW10 | January 2022 |\n| 750-364/xxx-xxx | >=FW10 | January 2022 |\n| 750-365/xxx-xxx | >=FW10 | January 2022 |\n\n", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "environmentalScore": 5.3, "environmentalSeverity": "MEDIUM", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 5.3, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021" ] } ], "title": "CVE-2021-31344" }, { "cve": "CVE-2021-31345", "cwe": { "id": "CWE-1284", "name": "Improper Validation of Specified Quantity in Input" }, "notes": [ { "category": "description", "text": "A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions). The total length of an UDP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on a user-defined applications that runs on top of the UDP protocol. (FSMD-2021-0006)", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021" ] }, "remediations": [ { "category": "mitigation", "details": "1. Use general security best practices to protect systems from local and network attacks.\n2. Do not allow direct access to the device from untrusted networks.\n3. Update to the latest firmware according to the table in chapter solutions.\n4. Disable the DHCP, DNS and the FTP port 21.\n5. Industrial control systems (ICS) should not be directly accessible from the Internet, but should be protected by consistently applying the defense-in-depth strategy. The BSI provides general information on securing ICS in the ICS Compendium [BSI2013] and on the official BSI website [BSI2021].\n\nFor fieldbus coupler:\n\n- 750-331\n- 750-352/xxx-xxx\n\nFor PLCs:\n\n- 750-829\n- 750-831/xxx-xxx\n- 750-852\n- 750-880/xxx-xxx\n- 750-881\n- 750-889\n\nThe listed fieldbus coupler and PLCs above are based on Nucleus V1 RTOS. At the moment there are no updates for this version available. Due to this reason WAGO recommends according to the recommendations of the BSI to implement the following measures:\n\n1. Enforce segmentation controls and proper network hygiene to reduce the risk of vulnerable devices. Restrict external communication paths and isolate vulnerable devices in zones as a mitigating measure.\n2. Ensure DHCP responses from non-authorized servers are blocked or discarded.\n3. Monitor network traffic for anomalies and discard invalid packets.\n4. Disable or block FTP, DHCP, DNS especially on critical network segments\n5. Please check regularly https://certvde.com/de/ for an update of this Advisory.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "For fieldbus coupler:\n\n- 750-332\n- 750-362/xxx-xxx\n- 750-363/xxx-xxx\n- 750-364/xxx-xxx\n- 750-365/xxx-xxx\n\nFor PLCs:\n\n- 750-823\n- 750-832/xxx-xxx\n- 750-862\n- 750-890/xxx-xxx\n- 750-891\n- 750-893\n\nWe recommend all effected users to update to the firmware version listed below:\n\n| Article Number | Fixed in Firmware Version | Availability |\n|----------------------|----------------------------|---------------------------|\n| 750-823 | >=FW10 | January 2022 |\n| 750-832/000-00x | >=FW10 | After BACnet certification|\n| 750-862 | >=FW10 | January 2022 |\n| 750-890/xxx-xxx | >=FW10 | January 2022 |\n| 750-891 | >=FW10 | January 2022 |\n| 750-893 | >=FW10 | January 2022 |\n| 750-332 | >=FW10 | After BACnet certification|\n| 750-362/xxx-xxx | >=FW10 | January 2022 |\n| 750-363/xxx-xxx | >=FW10 | January 2022 |\n| 750-364/xxx-xxx | >=FW10 | January 2022 |\n| 750-365/xxx-xxx | >=FW10 | January 2022 |\n\n", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.1, "environmentalSeverity": "CRITICAL", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.1, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021" ] } ], "title": "CVE-2021-31345" }, { "cve": "CVE-2021-31346", "cwe": { "id": "CWE-1284", "name": "Improper Validation of Specified Quantity in Input" }, "notes": [ { "category": "description", "text": "A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), SIMOTICS CONNECT 400 (All versions < V1.0.0.0). The total length of an ICMP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on the network buffer organization in memory. (FSMD-2021-0007)", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021" ] }, "remediations": [ { "category": "mitigation", "details": "1. Use general security best practices to protect systems from local and network attacks.\n2. Do not allow direct access to the device from untrusted networks.\n3. Update to the latest firmware according to the table in chapter solutions.\n4. Disable the DHCP, DNS and the FTP port 21.\n5. Industrial control systems (ICS) should not be directly accessible from the Internet, but should be protected by consistently applying the defense-in-depth strategy. The BSI provides general information on securing ICS in the ICS Compendium [BSI2013] and on the official BSI website [BSI2021].\n\nFor fieldbus coupler:\n\n- 750-331\n- 750-352/xxx-xxx\n\nFor PLCs:\n\n- 750-829\n- 750-831/xxx-xxx\n- 750-852\n- 750-880/xxx-xxx\n- 750-881\n- 750-889\n\nThe listed fieldbus coupler and PLCs above are based on Nucleus V1 RTOS. At the moment there are no updates for this version available. Due to this reason WAGO recommends according to the recommendations of the BSI to implement the following measures:\n\n1. Enforce segmentation controls and proper network hygiene to reduce the risk of vulnerable devices. Restrict external communication paths and isolate vulnerable devices in zones as a mitigating measure.\n2. Ensure DHCP responses from non-authorized servers are blocked or discarded.\n3. Monitor network traffic for anomalies and discard invalid packets.\n4. Disable or block FTP, DHCP, DNS especially on critical network segments\n5. Please check regularly https://certvde.com/de/ for an update of this Advisory.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "For fieldbus coupler:\n\n- 750-332\n- 750-362/xxx-xxx\n- 750-363/xxx-xxx\n- 750-364/xxx-xxx\n- 750-365/xxx-xxx\n\nFor PLCs:\n\n- 750-823\n- 750-832/xxx-xxx\n- 750-862\n- 750-890/xxx-xxx\n- 750-891\n- 750-893\n\nWe recommend all effected users to update to the firmware version listed below:\n\n| Article Number | Fixed in Firmware Version | Availability |\n|----------------------|----------------------------|---------------------------|\n| 750-823 | >=FW10 | January 2022 |\n| 750-832/000-00x | >=FW10 | After BACnet certification|\n| 750-862 | >=FW10 | January 2022 |\n| 750-890/xxx-xxx | >=FW10 | January 2022 |\n| 750-891 | >=FW10 | January 2022 |\n| 750-893 | >=FW10 | January 2022 |\n| 750-332 | >=FW10 | After BACnet certification|\n| 750-362/xxx-xxx | >=FW10 | January 2022 |\n| 750-363/xxx-xxx | >=FW10 | January 2022 |\n| 750-364/xxx-xxx | >=FW10 | January 2022 |\n| 750-365/xxx-xxx | >=FW10 | January 2022 |\n\n", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.1, "environmentalSeverity": "CRITICAL", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.1, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021" ] } ], "title": "CVE-2021-31346" }, { "cve": "CVE-2021-31881", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303). When processing a DHCP OFFER message, the DHCP client application does not validate the length of the Vendor option(s), leading to Denial-of-Service conditions. (FSMD-2021-0008)", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021" ] }, "remediations": [ { "category": "mitigation", "details": "1. Use general security best practices to protect systems from local and network attacks.\n2. Do not allow direct access to the device from untrusted networks.\n3. Update to the latest firmware according to the table in chapter solutions.\n4. Disable the DHCP, DNS and the FTP port 21.\n5. Industrial control systems (ICS) should not be directly accessible from the Internet, but should be protected by consistently applying the defense-in-depth strategy. The BSI provides general information on securing ICS in the ICS Compendium [BSI2013] and on the official BSI website [BSI2021].\n\nFor fieldbus coupler:\n\n- 750-331\n- 750-352/xxx-xxx\n\nFor PLCs:\n\n- 750-829\n- 750-831/xxx-xxx\n- 750-852\n- 750-880/xxx-xxx\n- 750-881\n- 750-889\n\nThe listed fieldbus coupler and PLCs above are based on Nucleus V1 RTOS. At the moment there are no updates for this version available. Due to this reason WAGO recommends according to the recommendations of the BSI to implement the following measures:\n\n1. Enforce segmentation controls and proper network hygiene to reduce the risk of vulnerable devices. Restrict external communication paths and isolate vulnerable devices in zones as a mitigating measure.\n2. Ensure DHCP responses from non-authorized servers are blocked or discarded.\n3. Monitor network traffic for anomalies and discard invalid packets.\n4. Disable or block FTP, DHCP, DNS especially on critical network segments\n5. Please check regularly https://certvde.com/de/ for an update of this Advisory.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "For fieldbus coupler:\n\n- 750-332\n- 750-362/xxx-xxx\n- 750-363/xxx-xxx\n- 750-364/xxx-xxx\n- 750-365/xxx-xxx\n\nFor PLCs:\n\n- 750-823\n- 750-832/xxx-xxx\n- 750-862\n- 750-890/xxx-xxx\n- 750-891\n- 750-893\n\nWe recommend all effected users to update to the firmware version listed below:\n\n| Article Number | Fixed in Firmware Version | Availability |\n|----------------------|----------------------------|---------------------------|\n| 750-823 | >=FW10 | January 2022 |\n| 750-832/000-00x | >=FW10 | After BACnet certification|\n| 750-862 | >=FW10 | January 2022 |\n| 750-890/xxx-xxx | >=FW10 | January 2022 |\n| 750-891 | >=FW10 | January 2022 |\n| 750-893 | >=FW10 | January 2022 |\n| 750-332 | >=FW10 | After BACnet certification|\n| 750-362/xxx-xxx | >=FW10 | January 2022 |\n| 750-363/xxx-xxx | >=FW10 | January 2022 |\n| 750-364/xxx-xxx | >=FW10 | January 2022 |\n| 750-365/xxx-xxx | >=FW10 | January 2022 |\n\n", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 7.5, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021" ] } ], "title": "CVE-2021-31881" }, { "cve": "CVE-2021-31882", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "notes": [ { "category": "description", "text": "A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303). The DHCP client application does not validate the length of the Domain Name Server IP option(s) (0x06) when processing DHCP ACK packets. This may lead to Denial-of-Service conditions. (FSMD-2021-0011)", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021" ] }, "remediations": [ { "category": "mitigation", "details": "1. Use general security best practices to protect systems from local and network attacks.\n2. Do not allow direct access to the device from untrusted networks.\n3. Update to the latest firmware according to the table in chapter solutions.\n4. Disable the DHCP, DNS and the FTP port 21.\n5. Industrial control systems (ICS) should not be directly accessible from the Internet, but should be protected by consistently applying the defense-in-depth strategy. The BSI provides general information on securing ICS in the ICS Compendium [BSI2013] and on the official BSI website [BSI2021].\n\nFor fieldbus coupler:\n\n- 750-331\n- 750-352/xxx-xxx\n\nFor PLCs:\n\n- 750-829\n- 750-831/xxx-xxx\n- 750-852\n- 750-880/xxx-xxx\n- 750-881\n- 750-889\n\nThe listed fieldbus coupler and PLCs above are based on Nucleus V1 RTOS. At the moment there are no updates for this version available. Due to this reason WAGO recommends according to the recommendations of the BSI to implement the following measures:\n\n1. Enforce segmentation controls and proper network hygiene to reduce the risk of vulnerable devices. Restrict external communication paths and isolate vulnerable devices in zones as a mitigating measure.\n2. Ensure DHCP responses from non-authorized servers are blocked or discarded.\n3. Monitor network traffic for anomalies and discard invalid packets.\n4. Disable or block FTP, DHCP, DNS especially on critical network segments\n5. Please check regularly https://certvde.com/de/ for an update of this Advisory.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "For fieldbus coupler:\n\n- 750-332\n- 750-362/xxx-xxx\n- 750-363/xxx-xxx\n- 750-364/xxx-xxx\n- 750-365/xxx-xxx\n\nFor PLCs:\n\n- 750-823\n- 750-832/xxx-xxx\n- 750-862\n- 750-890/xxx-xxx\n- 750-891\n- 750-893\n\nWe recommend all effected users to update to the firmware version listed below:\n\n| Article Number | Fixed in Firmware Version | Availability |\n|----------------------|----------------------------|---------------------------|\n| 750-823 | >=FW10 | January 2022 |\n| 750-832/000-00x | >=FW10 | After BACnet certification|\n| 750-862 | >=FW10 | January 2022 |\n| 750-890/xxx-xxx | >=FW10 | January 2022 |\n| 750-891 | >=FW10 | January 2022 |\n| 750-893 | >=FW10 | January 2022 |\n| 750-332 | >=FW10 | After BACnet certification|\n| 750-362/xxx-xxx | >=FW10 | January 2022 |\n| 750-363/xxx-xxx | >=FW10 | January 2022 |\n| 750-364/xxx-xxx | >=FW10 | January 2022 |\n| 750-365/xxx-xxx | >=FW10 | January 2022 |\n\n", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 7.5, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021" ] } ], "title": "CVE-2021-31882" }, { "cve": "CVE-2021-31883", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "notes": [ { "category": "description", "text": "A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303). When processing a DHCP ACK message, the DHCP client application does not validate the length of the Vendor option(s), leading to Denial-of-Service conditions. (FSMD-2021-0013)", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021" ] }, "remediations": [ { "category": "mitigation", "details": "1. Use general security best practices to protect systems from local and network attacks.\n2. Do not allow direct access to the device from untrusted networks.\n3. Update to the latest firmware according to the table in chapter solutions.\n4. Disable the DHCP, DNS and the FTP port 21.\n5. Industrial control systems (ICS) should not be directly accessible from the Internet, but should be protected by consistently applying the defense-in-depth strategy. The BSI provides general information on securing ICS in the ICS Compendium [BSI2013] and on the official BSI website [BSI2021].\n\nFor fieldbus coupler:\n\n- 750-331\n- 750-352/xxx-xxx\n\nFor PLCs:\n\n- 750-829\n- 750-831/xxx-xxx\n- 750-852\n- 750-880/xxx-xxx\n- 750-881\n- 750-889\n\nThe listed fieldbus coupler and PLCs above are based on Nucleus V1 RTOS. At the moment there are no updates for this version available. Due to this reason WAGO recommends according to the recommendations of the BSI to implement the following measures:\n\n1. Enforce segmentation controls and proper network hygiene to reduce the risk of vulnerable devices. Restrict external communication paths and isolate vulnerable devices in zones as a mitigating measure.\n2. Ensure DHCP responses from non-authorized servers are blocked or discarded.\n3. Monitor network traffic for anomalies and discard invalid packets.\n4. Disable or block FTP, DHCP, DNS especially on critical network segments\n5. Please check regularly https://certvde.com/de/ for an update of this Advisory.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "For fieldbus coupler:\n\n- 750-332\n- 750-362/xxx-xxx\n- 750-363/xxx-xxx\n- 750-364/xxx-xxx\n- 750-365/xxx-xxx\n\nFor PLCs:\n\n- 750-823\n- 750-832/xxx-xxx\n- 750-862\n- 750-890/xxx-xxx\n- 750-891\n- 750-893\n\nWe recommend all effected users to update to the firmware version listed below:\n\n| Article Number | Fixed in Firmware Version | Availability |\n|----------------------|----------------------------|---------------------------|\n| 750-823 | >=FW10 | January 2022 |\n| 750-832/000-00x | >=FW10 | After BACnet certification|\n| 750-862 | >=FW10 | January 2022 |\n| 750-890/xxx-xxx | >=FW10 | January 2022 |\n| 750-891 | >=FW10 | January 2022 |\n| 750-893 | >=FW10 | January 2022 |\n| 750-332 | >=FW10 | After BACnet certification|\n| 750-362/xxx-xxx | >=FW10 | January 2022 |\n| 750-363/xxx-xxx | >=FW10 | January 2022 |\n| 750-364/xxx-xxx | >=FW10 | January 2022 |\n| 750-365/xxx-xxx | >=FW10 | January 2022 |\n\n", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 7.5, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021" ] } ], "title": "CVE-2021-31883" }, { "cve": "CVE-2021-31884", "cwe": { "id": "CWE-170", "name": "Improper Null Termination" }, "notes": [ { "category": "description", "text": "A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.4), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.19), APOGEE PXC Modular (BACnet) (All versions < V3.5.4), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.19), Capital VSTAR (All versions with enabled Ethernet options), Desigo PXC00-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC00-U (All versions >= V2.3 and < V6.30.016), Desigo PXC001-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC100-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC12-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC128-U (All versions >= V2.3 and < V6.30.016), Desigo PXC200-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC36.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC50-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC64-U (All versions >= V2.3 and < V6.30.016), Desigo PXM20-E (All versions >= V2.3 and < V6.30.016), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus Source Code (All versions), TALON TC Compact (BACnet) (All versions < V3.5.4), TALON TC Modular (BACnet) (All versions < V3.5.4). The DHCP client application assumes that the data supplied with the “Hostname” DHCP option is NULL terminated. In cases when global hostname variable is not defined, this may lead to Out-of-bound reads, writes, and Denial-of-service conditions. (FSMD-2021-0014)", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021" ] }, "remediations": [ { "category": "mitigation", "details": "1. Use general security best practices to protect systems from local and network attacks.\n2. Do not allow direct access to the device from untrusted networks.\n3. Update to the latest firmware according to the table in chapter solutions.\n4. Disable the DHCP, DNS and the FTP port 21.\n5. Industrial control systems (ICS) should not be directly accessible from the Internet, but should be protected by consistently applying the defense-in-depth strategy. The BSI provides general information on securing ICS in the ICS Compendium [BSI2013] and on the official BSI website [BSI2021].\n\nFor fieldbus coupler:\n\n- 750-331\n- 750-352/xxx-xxx\n\nFor PLCs:\n\n- 750-829\n- 750-831/xxx-xxx\n- 750-852\n- 750-880/xxx-xxx\n- 750-881\n- 750-889\n\nThe listed fieldbus coupler and PLCs above are based on Nucleus V1 RTOS. At the moment there are no updates for this version available. Due to this reason WAGO recommends according to the recommendations of the BSI to implement the following measures:\n\n1. Enforce segmentation controls and proper network hygiene to reduce the risk of vulnerable devices. Restrict external communication paths and isolate vulnerable devices in zones as a mitigating measure.\n2. Ensure DHCP responses from non-authorized servers are blocked or discarded.\n3. Monitor network traffic for anomalies and discard invalid packets.\n4. Disable or block FTP, DHCP, DNS especially on critical network segments\n5. Please check regularly https://certvde.com/de/ for an update of this Advisory.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "For fieldbus coupler:\n\n- 750-332\n- 750-362/xxx-xxx\n- 750-363/xxx-xxx\n- 750-364/xxx-xxx\n- 750-365/xxx-xxx\n\nFor PLCs:\n\n- 750-823\n- 750-832/xxx-xxx\n- 750-862\n- 750-890/xxx-xxx\n- 750-891\n- 750-893\n\nWe recommend all effected users to update to the firmware version listed below:\n\n| Article Number | Fixed in Firmware Version | Availability |\n|----------------------|----------------------------|---------------------------|\n| 750-823 | >=FW10 | January 2022 |\n| 750-832/000-00x | >=FW10 | After BACnet certification|\n| 750-862 | >=FW10 | January 2022 |\n| 750-890/xxx-xxx | >=FW10 | January 2022 |\n| 750-891 | >=FW10 | January 2022 |\n| 750-893 | >=FW10 | January 2022 |\n| 750-332 | >=FW10 | After BACnet certification|\n| 750-362/xxx-xxx | >=FW10 | January 2022 |\n| 750-363/xxx-xxx | >=FW10 | January 2022 |\n| 750-364/xxx-xxx | >=FW10 | January 2022 |\n| 750-365/xxx-xxx | >=FW10 | January 2022 |\n\n", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021" ] } ], "title": "CVE-2021-31884" }, { "cve": "CVE-2021-31886", "cwe": { "id": "CWE-170", "name": "Improper Null Termination" }, "notes": [ { "category": "description", "text": "A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.4), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.19), APOGEE PXC Modular (BACnet) (All versions < V3.5.4), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.19), Desigo PXC00-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC00-U (All versions >= V2.3 and < V6.30.016), Desigo PXC001-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC100-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC12-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC128-U (All versions >= V2.3 and < V6.30.016), Desigo PXC200-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC36.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC50-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC64-U (All versions >= V2.3 and < V6.30.016), Desigo PXM20-E (All versions >= V2.3 and < V6.30.016), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus Source Code (All versions), TALON TC Compact (BACnet) (All versions < V3.5.4), TALON TC Modular (BACnet) (All versions < V3.5.4). FTP server does not properly validate the length of the “USER” command, leading to stack-based buffer overflows. This may result in Denial-of-Service conditions and Remote Code Execution. (FSMD-2021-0010)", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021" ] }, "remediations": [ { "category": "mitigation", "details": "1. Use general security best practices to protect systems from local and network attacks.\n2. Do not allow direct access to the device from untrusted networks.\n3. Update to the latest firmware according to the table in chapter solutions.\n4. Disable the DHCP, DNS and the FTP port 21.\n5. Industrial control systems (ICS) should not be directly accessible from the Internet, but should be protected by consistently applying the defense-in-depth strategy. The BSI provides general information on securing ICS in the ICS Compendium [BSI2013] and on the official BSI website [BSI2021].\n\nFor fieldbus coupler:\n\n- 750-331\n- 750-352/xxx-xxx\n\nFor PLCs:\n\n- 750-829\n- 750-831/xxx-xxx\n- 750-852\n- 750-880/xxx-xxx\n- 750-881\n- 750-889\n\nThe listed fieldbus coupler and PLCs above are based on Nucleus V1 RTOS. At the moment there are no updates for this version available. Due to this reason WAGO recommends according to the recommendations of the BSI to implement the following measures:\n\n1. Enforce segmentation controls and proper network hygiene to reduce the risk of vulnerable devices. Restrict external communication paths and isolate vulnerable devices in zones as a mitigating measure.\n2. Ensure DHCP responses from non-authorized servers are blocked or discarded.\n3. Monitor network traffic for anomalies and discard invalid packets.\n4. Disable or block FTP, DHCP, DNS especially on critical network segments\n5. Please check regularly https://certvde.com/de/ for an update of this Advisory.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "For fieldbus coupler:\n\n- 750-332\n- 750-362/xxx-xxx\n- 750-363/xxx-xxx\n- 750-364/xxx-xxx\n- 750-365/xxx-xxx\n\nFor PLCs:\n\n- 750-823\n- 750-832/xxx-xxx\n- 750-862\n- 750-890/xxx-xxx\n- 750-891\n- 750-893\n\nWe recommend all effected users to update to the firmware version listed below:\n\n| Article Number | Fixed in Firmware Version | Availability |\n|----------------------|----------------------------|---------------------------|\n| 750-823 | >=FW10 | January 2022 |\n| 750-832/000-00x | >=FW10 | After BACnet certification|\n| 750-862 | >=FW10 | January 2022 |\n| 750-890/xxx-xxx | >=FW10 | January 2022 |\n| 750-891 | >=FW10 | January 2022 |\n| 750-893 | >=FW10 | January 2022 |\n| 750-332 | >=FW10 | After BACnet certification|\n| 750-362/xxx-xxx | >=FW10 | January 2022 |\n| 750-363/xxx-xxx | >=FW10 | January 2022 |\n| 750-364/xxx-xxx | >=FW10 | January 2022 |\n| 750-365/xxx-xxx | >=FW10 | January 2022 |\n\n", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021" ] } ], "title": "CVE-2021-31886" }, { "cve": "CVE-2021-31887", "cwe": { "id": "CWE-170", "name": "Improper Null Termination" }, "notes": [ { "category": "description", "text": "A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.4), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.19), APOGEE PXC Modular (BACnet) (All versions < V3.5.4), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.19), Desigo PXC00-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC00-U (All versions >= V2.3 and < V6.30.016), Desigo PXC001-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC100-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC12-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC128-U (All versions >= V2.3 and < V6.30.016), Desigo PXC200-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC36.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC50-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC64-U (All versions >= V2.3 and < V6.30.016), Desigo PXM20-E (All versions >= V2.3 and < V6.30.016), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus Source Code (All versions), TALON TC Compact (BACnet) (All versions < V3.5.4), TALON TC Modular (BACnet) (All versions < V3.5.4). FTP server does not properly validate the length of the “PWD/XPWD” command, leading to stack-based buffer overflows. This may result in Denial-of-Service conditions and Remote Code Execution. (FSMD-2021-0016)", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021" ] }, "remediations": [ { "category": "mitigation", "details": "1. Use general security best practices to protect systems from local and network attacks.\n2. Do not allow direct access to the device from untrusted networks.\n3. Update to the latest firmware according to the table in chapter solutions.\n4. Disable the DHCP, DNS and the FTP port 21.\n5. Industrial control systems (ICS) should not be directly accessible from the Internet, but should be protected by consistently applying the defense-in-depth strategy. The BSI provides general information on securing ICS in the ICS Compendium [BSI2013] and on the official BSI website [BSI2021].\n\nFor fieldbus coupler:\n\n- 750-331\n- 750-352/xxx-xxx\n\nFor PLCs:\n\n- 750-829\n- 750-831/xxx-xxx\n- 750-852\n- 750-880/xxx-xxx\n- 750-881\n- 750-889\n\nThe listed fieldbus coupler and PLCs above are based on Nucleus V1 RTOS. At the moment there are no updates for this version available. Due to this reason WAGO recommends according to the recommendations of the BSI to implement the following measures:\n\n1. Enforce segmentation controls and proper network hygiene to reduce the risk of vulnerable devices. Restrict external communication paths and isolate vulnerable devices in zones as a mitigating measure.\n2. Ensure DHCP responses from non-authorized servers are blocked or discarded.\n3. Monitor network traffic for anomalies and discard invalid packets.\n4. Disable or block FTP, DHCP, DNS especially on critical network segments\n5. Please check regularly https://certvde.com/de/ for an update of this Advisory.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "For fieldbus coupler:\n\n- 750-332\n- 750-362/xxx-xxx\n- 750-363/xxx-xxx\n- 750-364/xxx-xxx\n- 750-365/xxx-xxx\n\nFor PLCs:\n\n- 750-823\n- 750-832/xxx-xxx\n- 750-862\n- 750-890/xxx-xxx\n- 750-891\n- 750-893\n\nWe recommend all effected users to update to the firmware version listed below:\n\n| Article Number | Fixed in Firmware Version | Availability |\n|----------------------|----------------------------|---------------------------|\n| 750-823 | >=FW10 | January 2022 |\n| 750-832/000-00x | >=FW10 | After BACnet certification|\n| 750-862 | >=FW10 | January 2022 |\n| 750-890/xxx-xxx | >=FW10 | January 2022 |\n| 750-891 | >=FW10 | January 2022 |\n| 750-893 | >=FW10 | January 2022 |\n| 750-332 | >=FW10 | After BACnet certification|\n| 750-362/xxx-xxx | >=FW10 | January 2022 |\n| 750-363/xxx-xxx | >=FW10 | January 2022 |\n| 750-364/xxx-xxx | >=FW10 | January 2022 |\n| 750-365/xxx-xxx | >=FW10 | January 2022 |\n\n", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 8.8, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 8.8, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021" ] } ], "title": "CVE-2021-31887" }, { "cve": "CVE-2021-31888", "cwe": { "id": "CWE-170", "name": "Improper Null Termination" }, "notes": [ { "category": "description", "text": "A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.4), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.19), APOGEE PXC Modular (BACnet) (All versions < V3.5.4), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.19), Desigo PXC00-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC00-U (All versions >= V2.3 and < V6.30.016), Desigo PXC001-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC100-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC12-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC128-U (All versions >= V2.3 and < V6.30.016), Desigo PXC200-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC36.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC50-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC64-U (All versions >= V2.3 and < V6.30.016), Desigo PXM20-E (All versions >= V2.3 and < V6.30.016), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus Source Code (All versions), TALON TC Compact (BACnet) (All versions < V3.5.4), TALON TC Modular (BACnet) (All versions < V3.5.4). FTP server does not properly validate the length of the “MKD/XMKD” command, leading to stack-based buffer overflows. This may result in Denial-of-Service conditions and Remote Code Execution. (FSMD-2021-0018)", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021" ] }, "remediations": [ { "category": "mitigation", "details": "1. Use general security best practices to protect systems from local and network attacks.\n2. Do not allow direct access to the device from untrusted networks.\n3. Update to the latest firmware according to the table in chapter solutions.\n4. Disable the DHCP, DNS and the FTP port 21.\n5. Industrial control systems (ICS) should not be directly accessible from the Internet, but should be protected by consistently applying the defense-in-depth strategy. The BSI provides general information on securing ICS in the ICS Compendium [BSI2013] and on the official BSI website [BSI2021].\n\nFor fieldbus coupler:\n\n- 750-331\n- 750-352/xxx-xxx\n\nFor PLCs:\n\n- 750-829\n- 750-831/xxx-xxx\n- 750-852\n- 750-880/xxx-xxx\n- 750-881\n- 750-889\n\nThe listed fieldbus coupler and PLCs above are based on Nucleus V1 RTOS. At the moment there are no updates for this version available. Due to this reason WAGO recommends according to the recommendations of the BSI to implement the following measures:\n\n1. Enforce segmentation controls and proper network hygiene to reduce the risk of vulnerable devices. Restrict external communication paths and isolate vulnerable devices in zones as a mitigating measure.\n2. Ensure DHCP responses from non-authorized servers are blocked or discarded.\n3. Monitor network traffic for anomalies and discard invalid packets.\n4. Disable or block FTP, DHCP, DNS especially on critical network segments\n5. Please check regularly https://certvde.com/de/ for an update of this Advisory.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "For fieldbus coupler:\n\n- 750-332\n- 750-362/xxx-xxx\n- 750-363/xxx-xxx\n- 750-364/xxx-xxx\n- 750-365/xxx-xxx\n\nFor PLCs:\n\n- 750-823\n- 750-832/xxx-xxx\n- 750-862\n- 750-890/xxx-xxx\n- 750-891\n- 750-893\n\nWe recommend all effected users to update to the firmware version listed below:\n\n| Article Number | Fixed in Firmware Version | Availability |\n|----------------------|----------------------------|---------------------------|\n| 750-823 | >=FW10 | January 2022 |\n| 750-832/000-00x | >=FW10 | After BACnet certification|\n| 750-862 | >=FW10 | January 2022 |\n| 750-890/xxx-xxx | >=FW10 | January 2022 |\n| 750-891 | >=FW10 | January 2022 |\n| 750-893 | >=FW10 | January 2022 |\n| 750-332 | >=FW10 | After BACnet certification|\n| 750-362/xxx-xxx | >=FW10 | January 2022 |\n| 750-363/xxx-xxx | >=FW10 | January 2022 |\n| 750-364/xxx-xxx | >=FW10 | January 2022 |\n| 750-365/xxx-xxx | >=FW10 | January 2022 |\n\n", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 8.8, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 8.8, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021" ] } ], "title": "CVE-2021-31888" }, { "cve": "CVE-2021-31889", "cwe": { "id": "CWE-191", "name": "Integer Underflow (Wrap or Wraparound)" }, "notes": [ { "category": "description", "text": "A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions), SIMOTICS CONNECT 400 (All versions < V0.5.0.0). Malformed TCP packets with a corrupted SACK option leads to Information Leaks and Denial-of-Service conditions. (FSMD-2021-0015)", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021" ] }, "remediations": [ { "category": "mitigation", "details": "1. Use general security best practices to protect systems from local and network attacks.\n2. Do not allow direct access to the device from untrusted networks.\n3. Update to the latest firmware according to the table in chapter solutions.\n4. Disable the DHCP, DNS and the FTP port 21.\n5. Industrial control systems (ICS) should not be directly accessible from the Internet, but should be protected by consistently applying the defense-in-depth strategy. The BSI provides general information on securing ICS in the ICS Compendium [BSI2013] and on the official BSI website [BSI2021].\n\nFor fieldbus coupler:\n\n- 750-331\n- 750-352/xxx-xxx\n\nFor PLCs:\n\n- 750-829\n- 750-831/xxx-xxx\n- 750-852\n- 750-880/xxx-xxx\n- 750-881\n- 750-889\n\nThe listed fieldbus coupler and PLCs above are based on Nucleus V1 RTOS. At the moment there are no updates for this version available. Due to this reason WAGO recommends according to the recommendations of the BSI to implement the following measures:\n\n1. Enforce segmentation controls and proper network hygiene to reduce the risk of vulnerable devices. Restrict external communication paths and isolate vulnerable devices in zones as a mitigating measure.\n2. Ensure DHCP responses from non-authorized servers are blocked or discarded.\n3. Monitor network traffic for anomalies and discard invalid packets.\n4. Disable or block FTP, DHCP, DNS especially on critical network segments\n5. Please check regularly https://certvde.com/de/ for an update of this Advisory.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "For fieldbus coupler:\n\n- 750-332\n- 750-362/xxx-xxx\n- 750-363/xxx-xxx\n- 750-364/xxx-xxx\n- 750-365/xxx-xxx\n\nFor PLCs:\n\n- 750-823\n- 750-832/xxx-xxx\n- 750-862\n- 750-890/xxx-xxx\n- 750-891\n- 750-893\n\nWe recommend all effected users to update to the firmware version listed below:\n\n| Article Number | Fixed in Firmware Version | Availability |\n|----------------------|----------------------------|---------------------------|\n| 750-823 | >=FW10 | January 2022 |\n| 750-832/000-00x | >=FW10 | After BACnet certification|\n| 750-862 | >=FW10 | January 2022 |\n| 750-890/xxx-xxx | >=FW10 | January 2022 |\n| 750-891 | >=FW10 | January 2022 |\n| 750-893 | >=FW10 | January 2022 |\n| 750-332 | >=FW10 | After BACnet certification|\n| 750-362/xxx-xxx | >=FW10 | January 2022 |\n| 750-363/xxx-xxx | >=FW10 | January 2022 |\n| 750-364/xxx-xxx | >=FW10 | January 2022 |\n| 750-365/xxx-xxx | >=FW10 | January 2022 |\n\n", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.1, "environmentalSeverity": "CRITICAL", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.1, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021" ] } ], "title": "CVE-2021-31889" }, { "cve": "CVE-2021-31890", "cwe": { "id": "CWE-240", "name": "Improper Handling of Inconsistent Structural Elements" }, "notes": [ { "category": "description", "text": "A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), SIMOTICS CONNECT 400 (All versions < V1.0.0.0). The total length of an TCP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on the network buffer organization in memory. (FSMD-2021-0017)", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021" ] }, "remediations": [ { "category": "mitigation", "details": "1. Use general security best practices to protect systems from local and network attacks.\n2. Do not allow direct access to the device from untrusted networks.\n3. Update to the latest firmware according to the table in chapter solutions.\n4. Disable the DHCP, DNS and the FTP port 21.\n5. Industrial control systems (ICS) should not be directly accessible from the Internet, but should be protected by consistently applying the defense-in-depth strategy. The BSI provides general information on securing ICS in the ICS Compendium [BSI2013] and on the official BSI website [BSI2021].\n\nFor fieldbus coupler:\n\n- 750-331\n- 750-352/xxx-xxx\n\nFor PLCs:\n\n- 750-829\n- 750-831/xxx-xxx\n- 750-852\n- 750-880/xxx-xxx\n- 750-881\n- 750-889\n\nThe listed fieldbus coupler and PLCs above are based on Nucleus V1 RTOS. At the moment there are no updates for this version available. Due to this reason WAGO recommends according to the recommendations of the BSI to implement the following measures:\n\n1. Enforce segmentation controls and proper network hygiene to reduce the risk of vulnerable devices. Restrict external communication paths and isolate vulnerable devices in zones as a mitigating measure.\n2. Ensure DHCP responses from non-authorized servers are blocked or discarded.\n3. Monitor network traffic for anomalies and discard invalid packets.\n4. Disable or block FTP, DHCP, DNS especially on critical network segments\n5. Please check regularly https://certvde.com/de/ for an update of this Advisory.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "For fieldbus coupler:\n\n- 750-332\n- 750-362/xxx-xxx\n- 750-363/xxx-xxx\n- 750-364/xxx-xxx\n- 750-365/xxx-xxx\n\nFor PLCs:\n\n- 750-823\n- 750-832/xxx-xxx\n- 750-862\n- 750-890/xxx-xxx\n- 750-891\n- 750-893\n\nWe recommend all effected users to update to the firmware version listed below:\n\n| Article Number | Fixed in Firmware Version | Availability |\n|----------------------|----------------------------|---------------------------|\n| 750-823 | >=FW10 | January 2022 |\n| 750-832/000-00x | >=FW10 | After BACnet certification|\n| 750-862 | >=FW10 | January 2022 |\n| 750-890/xxx-xxx | >=FW10 | January 2022 |\n| 750-891 | >=FW10 | January 2022 |\n| 750-893 | >=FW10 | January 2022 |\n| 750-332 | >=FW10 | After BACnet certification|\n| 750-362/xxx-xxx | >=FW10 | January 2022 |\n| 750-363/xxx-xxx | >=FW10 | January 2022 |\n| 750-364/xxx-xxx | >=FW10 | January 2022 |\n| 750-365/xxx-xxx | >=FW10 | January 2022 |\n\n", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.1, "environmentalSeverity": "CRITICAL", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.1, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013", "CSAFPID-31014", "CSAFPID-31015", "CSAFPID-31016", "CSAFPID-31017", "CSAFPID-31018", "CSAFPID-31019", "CSAFPID-31020", "CSAFPID-31021" ] } ], "title": "CVE-2021-31890" } ] } ``` ## [vde-2020-048](https://vulnerability.circl.lu/vuln/vde-2020-048) ```json { "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "tracking": { "generator": { "date": "2025-06-25T07:30:15.496Z", "engine": { "version": "2.5.28", "name": "Secvisogram" } }, "id": "VDE-2020-048", "version": "1.0.0", "status": "final", "aliases": [ "VDE-2020-048" ], "revision_history": [ { "number": "1.0.0", "summary": "initial revision", "date": "2021-01-14T14:57:00.000Z" } ], "current_release_date": "2021-01-14T14:57:00.000Z", "initial_release_date": "2021-01-14T14:57:00.000Z" }, "lang": "en-GB", "title": "M&M Software (WAGO): Deserialisation of untrusted data in fdtContainer", "acknowledgments": [ { "organization": "CERTVDE", "urls": [ "https://certvde.com" ], "summary": "coordination" }, { "organization": "customer of the fdtCONTAINER", "summary": "reporting" } ], "distribution": { "tlp": { "label": "WHITE" } }, "notes": [ { "category": "summary", "title": "Summary", "text": "The fdtCONTAINER component is integrated into an application (host application). The fdtCONTAINER application is a specific host application which integrates the fdtCONTAINER component.\n\nThe fdtCONTAINER component exchanges binary data blobs with such a host application. Typically, the host application saves these binary data blobs into a project storage (project file or a project database).\n\nTo manipulate the data inside the project storage, the attacker needs write access to this project storage. Additionally, the manipulated project needs to be opened by the host application. It depends on the host application whether opening the project requires a user action or not. In\nfdtCONTAINER applications, the user has to open the manipulated project file manually.\n\nIn the case of opening a stored project, the deserialization of the manipulated data can be exploited." }, { "category": "description", "title": "Impact", "text": "The engineering workstation, on which the host application is executed, might execute malicious code with the user rights of the host application." }, { "category": "description", "title": "Mitigation", "text": "- Exchange project data only via secure exchange services\n- Use appropriate means to protect the project storage from unauthorized manipulation\n- Do not open project data from an unknown source\n- Reduce the user rights of the host application to the necessary minimum" }, { "category": "description", "title": "Remediation", "text": "M&M provides two technical solution options. Customers may choose between the following:\n\n---\n\n### Option 1:\n\nUpdate the `fdtCONTAINER component` or `fdtCONTAINER application` to a version that offers **more secure deserialization** of project data.\n\n- This version still uses a **deprecated serialization technology**, \n but fixes the currently known attack vector.\n- It remains **compatible with existing, non-manipulated project files**.\n\n**Implemented in:**\n- `fdtCONTAINER component`: **3.6.20304.x – < 3.7**\n- `fdtCONTAINER application`: **4.6.20304.x – < 4.7**\n\n---\n\n### Option 2:\n\nUpdate the `fdtCONTAINER component` or `fdtCONTAINER application` to a version that uses an **updated serialization technology** for deserialization.\n\n- This option ensures **secure handling of project data**.\n- **Incompatible** with existing, non-manipulated project files.\n\n**Implemented in:**\n- `fdtCONTAINER component`: **≥ 3.7**\n- `fdtCONTAINER application`: **≥ 4.7**\n\n---\n\nThe fixed version of `dtmINSPECTOR` will also apply **Option 2** \nand is planned to be available in **Q1 2021**." } ], "publisher": { "category": "vendor", "contact_details": "psirt@wago.com", "name": "WAGO GmbH & Co. KG", "namespace": "https://www.wago.com/psirt" }, "references": [ { "category": "external", "summary": "WAGO GmbH & Co. KG", "url": "https://www.wago.com/psirt" }, { "category": "external", "summary": "CERT@VDE Security Advisories for WAGO", "url": "https://certvde.com/en/advisories/vendor/wago/" }, { "category": "self", "url": "https://certvde.com/en/advisories/VDE-2020-048/", "summary": "VDE-2020-048: M&M Software (WAGO): Deserialisation of untrusted data in fdtContainer - HTML" }, { "summary": "VDE-2020-048: M&M Software (WAGO): Deserialisation of untrusted data in fdtContainer - CSAF", "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2021/vde-2020-048.json", "category": "self" } ] }, "product_tree": { "branches": [ { "name": "M&M Software (WAGO)", "category": "vendor", "branches": [ { "name": "Software", "category": "product_family", "branches": [ { "name": "dtmINSPECTOR bBased on FDT 1.2.x", "category": "product_name", "branches": [ { "name": "3", "category": "product_version", "product": { "name": "dtmINSPECTOR bBased on FDT 1.2.x 3", "product_id": "CSAFPID-51001" } } ] }, { "name": "fdtCONTAINER application", "category": "product_name", "branches": [ { "name": "<4.5", "category": "product_version_range", "product": { "name": "fdtCONTAINER application <4.5", "product_id": "CSAFPID-51002" } }, { "name": "4.5.0<4.5.20304.x", "category": "product_version_range", "product": { "name": "fdtCONTAINER application 4.5.0<4.5.20304.x", "product_id": "CSAFPID-51003" } }, { "name": "4.6.0<4.6.20304.x", "category": "product_version_range", "product": { "name": "fdtCONTAINER application 4.6.0<4.6.20304.x", "product_id": "CSAFPID-51004" } }, { "name": "4.7", "category": "product_version", "product": { "name": "fdtCONTAINER application 4.7", "product_id": "CSAFPID-52001" } } ] }, { "name": "fdtCONTAINER component", "category": "product_name", "branches": [ { "name": "3.5.0<3.5.20304.x", "category": "product_version_range", "product": { "name": "fdtCONTAINER component 3.5.0<3.5.20304.x", "product_id": "CSAFPID-51005" } }, { "name": "3.6.0<3.6.20304.x", "category": "product_version_range", "product": { "name": "fdtCONTAINER component 3.6.0<3.6.20304.x", "product_id": "CSAFPID-51006" } }, { "name": "<3.5", "category": "product_version_range", "product": { "name": "fdtCONTAINER component <3.5", "product_id": "CSAFPID-51007" } }, { "name": "3.7", "category": "product_version", "product": { "name": "fdtCONTAINER component 3.7", "product_id": "CSAFPID-52002" } } ] } ] } ] } ], "product_groups": [ { "group_id": "CSAFGID-0001", "summary": "Affected Products", "product_ids": [ "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004", "CSAFPID-51005", "CSAFPID-51006", "CSAFPID-51007" ] }, { "group_id": "CSAFGID-0002", "summary": "Fixed Products", "product_ids": [ "CSAFPID-52001", "CSAFPID-52002" ] } ] }, "vulnerabilities": [ { "cve": "CVE-2020-12525", "product_status": { "known_affected": [ "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004", "CSAFPID-51005", "CSAFPID-51006", "CSAFPID-51007" ], "fixed": [ "CSAFPID-52001", "CSAFPID-52002" ] }, "scores": [ { "products": [ "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004", "CSAFPID-51005", "CSAFPID-51006", "CSAFPID-51007" ], "cvss_v3": { "version": "3.0", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.3, "baseSeverity": "HIGH", "temporalScore": 7.3, "temporalSeverity": "HIGH", "environmentalScore": 7.3, "environmentalSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH" } } ], "notes": [ { "audience": "all", "category": "description", "title": "Vulnerability Description", "text": "M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its project storage." } ], "remediations": [ { "category": "mitigation", "details": "- Exchange project data only via secure exchange services\n- Use appropriate means to protect the project storage from unauthorized manipulation\n- Do not open project data from an unknown source\n- Reduce the user rights of the host application to the necessary minimum", "group_ids": [ "CSAFGID-0001" ] }, { "group_ids": [ "CSAFGID-0002" ], "category": "vendor_fix", "details": "M&M provides two technical solution options. Customers may choose between the following:\n\n---\n\n### Option 1:\n\nUpdate the `fdtCONTAINER component` or `fdtCONTAINER application` to a version that offers **more secure deserialization** of project data.\n\n- This version still uses a **deprecated serialization technology**, \n but fixes the currently known attack vector.\n- It remains **compatible with existing, non-manipulated project files**.\n\n**Implemented in:**\n- `fdtCONTAINER component`: **3.6.20304.x – < 3.7**\n- `fdtCONTAINER application`: **4.6.20304.x – < 4.7**\n\n---\n\n### Option 2:\n\nUpdate the `fdtCONTAINER component` or `fdtCONTAINER application` to a version that uses an **updated serialization technology** for deserialization.\n\n- This option ensures **secure handling of project data**.\n- **Incompatible** with existing, non-manipulated project files.\n\n**Implemented in:**\n- `fdtCONTAINER component`: **≥ 3.7**\n- `fdtCONTAINER application`: **≥ 4.7**\n\n---\n\nThe fixed version of `dtmINSPECTOR` will also apply **Option 2** \nand is planned to be available in **Q1 2021**." } ], "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "title": "CVE-2020-12525" } ] } ``` ## [vde-2020-015](https://vulnerability.circl.lu/vuln/vde-2020-015) ```json { "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "tracking": { "generator": { "date": "2025-01-15T13:54:25.657Z", "engine": { "version": "2.5.16", "name": "Secvisogram" } }, "current_release_date": "2020-06-10T08:00:00.000Z", "id": "VDE-2020-015", "initial_release_date": "2020-06-10T08:00:00.000Z", "status": "final", "version": "1", "revision_history": [ { "summary": "Initial revision.", "date": "2020-06-10T08:00:00.000Z", "number": "1" } ], "aliases": [ "VDE-2020-015" ] }, "lang": "en-GB", "title": "WAGO: Web Based Management - Code Execution Vulnerability", "acknowledgments": [ { "summary": "coordination", "organization": "CERT@VDE" }, { "summary": "reported", "organization": "Cisco Talos", "names": [ "Kelly Leuschner" ] } ], "distribution": { "tlp": { "url": "https://www.first.org/tlp/", "label": "WHITE" } }, "notes": [ { "title": "Summary", "category": "summary", "text": "The Web-Based Management (WBM) of WAGOs programmable logic controller (PLC) is typically used for administration, commissioning and updates. \n\nAn attacker needs an authorized login with administrative privileges on the device in order to exploit the herein mentioned vulnerability.\n\n An authenticated attacker who has access to the Web Based Management (WBM) could use the software upload functionality to install software package with root privileges. This fact could be potentially used to manipulate the device or to get control of the device." }, { "title": "Impact", "category": "description", "text": "Based on the described issue, an authenticated attacker is able to install software packages with extended rights. This is an intended functionality to provide the user with a convenient way to install software on the device." }, { "title": "Remediation", "text": "In previous versions of the WAGO product manuals, a distinction between the WBM and the Linux system was made. This information was misleading and WAGO has corrected this in current versions of the manuals, which are expected to be update in June 2020.\n\n Valid from FW version 03.04.10(16) / chapter 5.1.2.1.2", "category": "description" }, { "text": "Use strong passwords for administrative accounts on the device\nFollow the instructions in WAGOs handbook Cyber Security for Controller\nRestrict network access to the device.\nDo not directly connect the device to the internet", "category": "description", "title": "Mitigation" } ], "publisher": { "category": "vendor", "name": "WAGO GmbH & Co. KG", "namespace": "https://www.wago.com/psirt", "contact_details": "psirt@wago.com" }, "references": [ { "summary": "CERT@VDE Security Advisories for WAGO", "url": "https://certvde.com/en/advisories/vendor/wago/", "category": "external" }, { "summary": "VDE-2020-015: WAGO: Web Based Management - Code Execution Vulnerability - HTML", "url": "https://certvde.com/de/advisories/VDE-2020-015/", "category": "self" }, { "summary": "VDE-2020-015: WAGO: Web Based Management - Code Execution Vulnerability - CSAF", "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2020/vde-2020-015.json", "category": "self" } ] }, "product_tree": { "branches": [ { "name": "WAGO", "category": "vendor", "branches": [ { "category": "product_family", "name": "Hardware", "branches": [ { "name": "PFC100", "category": "product_name", "product": { "name": "PFC100", "product_id": "CSAFPID-11001", "product_identification_helper": { "model_numbers": [ "750-81xx/xxx-xxx" ] } } }, { "name": "PFC200", "category": "product_name", "product": { "name": "PFC200", "product_id": "CSAFPID-11002", "product_identification_helper": { "model_numbers": [ "750-82xx/xxx-xxx" ] } } }, { "name": "762-4xxx", "category": "product_name", "product": { "name": "762-4xxx", "product_id": "CSAFPID-11003", "product_identification_helper": { "model_numbers": [ "762-4xxx" ] } } }, { "name": "762-5xxx", "category": "product_name", "product": { "name": "762-5xxx", "product_id": "CSAFPID-11004", "product_identification_helper": { "model_numbers": [ "762-5xxx" ] } } }, { "category": "product_name", "name": "762-6xxx", "product": { "name": "762-6xxx", "product_id": "CSAFPID-11005", "product_identification_helper": { "model_numbers": [ "762-6xxx" ] } } } ] }, { "category": "product_family", "name": "Firmware", "branches": [ { "category": "product_name", "name": "03.04.10(FW16)", "product": { "name": "Firmware 03.04.10(FW16)", "product_id": "CSAFPID-22001" } }, { "name": "<03.04.10(FW16)", "category": "product_version_range", "product": { "name": "Firmware <03.04.10(FW16)", "product_id": "CSAFPID-21001" } } ] } ] } ], "relationships": [ { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11001", "full_product_name": { "name": "Firmware <03.04.10(FW16) installed on PFC100", "product_id": "CSAFPID-31001" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11002", "full_product_name": { "name": "Firmware <03.04.10(FW16) installed on PFC200", "product_id": "CSAFPID-31002" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11003", "full_product_name": { "name": "Firmware <03.04.10(FW16) installed on 762-4xxx", "product_id": "CSAFPID-31003" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11004", "full_product_name": { "name": "Firmware <03.04.10(FW16) installed on 762-5xxx", "product_id": "CSAFPID-31004" } }, { "category": "installed_on", "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11005", "full_product_name": { "name": "Firmware <03.04.10(FW16) installed on 762-6xxx", "product_id": "CSAFPID-31005" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11001", "full_product_name": { "name": "Firmware 03.04.10(FW16) installed on PFC100", "product_id": "CSAFPID-32001" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11002", "full_product_name": { "name": "Firmware 03.04.10(FW16) installed on PFC200", "product_id": "CSAFPID-32002" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11003", "full_product_name": { "name": "Firmware 03.04.10(FW16) installed on 762-4xxx", "product_id": "CSAFPID-32003" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11004", "full_product_name": { "name": "Firmware 03.04.10(FW16) installed on 762-5xxx", "product_id": "CSAFPID-32004" } }, { "category": "installed_on", "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11005", "full_product_name": { "name": "Firmware 03.04.10(FW16) installed on 762-6xxx", "product_id": "CSAFPID-32005" } } ], "product_groups": [ { "group_id": "CSAFGID-0001", "summary": "Affected products.", "product_ids": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005" ] }, { "group_id": "CSAFGID-0002", "summary": "Fixed products.", "product_ids": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005" ] } ] }, "vulnerabilities": [ { "cve": "CVE-2020-6090", "title": "CVE-2020-6090", "cwe": { "id": "CWE-269", "name": "Improper Privilege Management" }, "notes": [ { "title": "Vulnerability Description", "category": "description", "text": "An exploitable code execution vulnerability exists in the Web-Based Management (WBM) functionality of WAGO PFC 200 03.03.10(15). A specially crafted series of HTTP requests can cause code execution resulting in remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability." } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005" ] }, "remediations": [ { "category": "vendor_fix", "details": "In previous versions of the WAGO product manuals, a distinction between the WBM and the Linux system was made. This information was misleading and WAGO has corrected this in current versions of the manuals, which are expected to be update in June 2020.\n\n Valid from FW version 03.04.10(16) / chapter 5.1.2.1.2", "product_ids": [ "CSAFPID-11001", "CSAFPID-11002", "CSAFPID-11003" ], "group_ids": [ "CSAFGID-0001" ] }, { "details": "Use strong passwords for administrative accounts on the device\nFollow the instructions in WAGOs handbook Cyber Security for Controller\nRestrict network access to the device.\nDo not directly connect the device to the internet", "category": "mitigation", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL", "temporalScore": 9.1, "temporalSeverity": "CRITICAL", "environmentalScore": 9.1, "environmentalSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH" }, "products": [ "CSAFPID-11001", "CSAFPID-11002", "CSAFPID-11003" ] } ] } ] } ``` ## [vde-2020-010](https://vulnerability.circl.lu/vuln/vde-2020-010) ```json { "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] }, { "names": [ "Kelly Leuschner" ], "organization": "Cisco Talos", "summary": "reporting" } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "An attacker needs an authorized login with administrative privileges on the device in order to exploit the herein mentioned vulnerability.\nThe weakness allows an attacker which has admin privileges on the device to redirect to his own Azure cloud account and install malicious software with the firmware update functionality.", "title": "Summary" }, { "category": "description", "text": "These vulnerabilities allow an attacker which has admin privileges, an Azure cloud account and also access to the device to redirect the cloud connection. With thus he is able to install any malicious software by manipulating the firmware update file.\n\nAn exploitable remote code execution vulnerability exists in the Cloud Connectivity functionality of affected WAGO products. A specially crafted XML file will direct the Cloud Connectivity service to download and execute a shell script with root privileges.", "title": "Impact" }, { "category": "description", "text": "Check the hashes of the Update packet, do not use update files which has a different hash then the original one\nFollow the instructions in WAGOs handbook Cyber Security for Controller\nRestrict network access to the device.\nDo not directly connect the device to the internet\nUse an encrypted VPN connection to the device\nDisable unused TCP/UDP-ports\n\nUse strong passwords for all user accounts, especially for administrative user accounts on the device.", "title": "Mitigation" } ], "publisher": { "category": "vendor", "contact_details": "psirt@wago.com", "name": "WAGO GmbH & Co. KG", "namespace": "https://www.wago.com/psirt" }, "references": [ { "category": "external", "summary": "CERT@VDE Security Advisories for Wago", "url": "https://certvde.com/en/advisories/vendor/wago" }, { "category": "self", "summary": "VDE-2020-010: WAGO: Cloud Connectivity Remote Code Execution Vulnerability - HTML", "url": "https://certvde.com/en/advisories/VDE-2020-010" }, { "summary": "VDE-2020-010: WAGO: Cloud Connectivity Remote Code Execution Vulnerability - CSAF", "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2020/vde-2020-010.json", "category": "self" } ], "title": "WAGO: Cloud Connectivity Remote Code Execution Vulnerability", "tracking": { "aliases": [ "VDE-2020-010" ], "current_release_date": "2020-03-09T09:25:00.000Z", "generator": { "date": "2025-03-20T08:55:11.026Z", "engine": { "name": "Secvisogram", "version": "2.5.21" } }, "id": "VDE-2020-010", "initial_release_date": "2020-03-09T09:25:00.000Z", "revision_history": [ { "date": "2020-03-09T09:25:00.000Z", "number": "1", "summary": "Initial revision." } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "name": "Hardware", "category": "product_family", "branches": [ { "name": "750-82xx/xxx-xxx (PFC200)", "category": "product_name", "product": { "name": "750-82xx/xxx-xxx (PFC200)", "product_id": "CSAFPID-11002" } }, { "name": "762-4xxx", "category": "product_name", "product": { "name": "762-4xxx", "product_id": "CSAFPID-11003" } }, { "name": "762-5xxx", "category": "product_name", "product": { "name": "762-5xxx", "product_id": "CSAFPID-11004" } }, { "name": "762-6xxx", "category": "product_name", "product": { "name": "762-6xxx", "product_id": "CSAFPID-11005" } }, { "name": "750-81xx/xxx-xxx (PFC100)", "category": "product_name", "product": { "name": "750-81xx/xxx-xxx (PFC100)", "product_id": "CSAFPID-11006" } } ] }, { "name": "Firmware", "branches": [ { "name": ">=FW12", "category": "product_version_range", "product": { "name": "Firmware >=FW12", "product_id": "CSAFPID-21001" } } ], "category": "product_family" } ], "category": "vendor", "name": "WAGO" } ], "relationships": [ { "relates_to_product_reference": "CSAFPID-11006", "product_reference": "CSAFPID-21001", "category": "installed_on", "full_product_name": { "name": "Firmware >=FW12 installed on 750-81xx/xxx-xxx (PFC100)", "product_id": "CSAFPID-31001" } }, { "relates_to_product_reference": "CSAFPID-11002", "product_reference": "CSAFPID-21001", "category": "installed_on", "full_product_name": { "name": "Firmware >=FW12 installed on 750-82xx/xxx-xxx (PFC200)", "product_id": "CSAFPID-31002" } }, { "relates_to_product_reference": "CSAFPID-11003", "product_reference": "CSAFPID-21001", "category": "installed_on", "full_product_name": { "name": "Firmware >=FW12 installed on 762-4xxx", "product_id": "CSAFPID-31003" } }, { "relates_to_product_reference": "CSAFPID-11004", "product_reference": "CSAFPID-21001", "category": "installed_on", "full_product_name": { "name": "Firmware >=FW12 installed on 762-5xxx", "product_id": "CSAFPID-31004" } }, { "relates_to_product_reference": "CSAFPID-11005", "product_reference": "CSAFPID-21001", "category": "installed_on", "full_product_name": { "name": "Firmware >=FW12 installed on 762-6xxx", "product_id": "CSAFPID-31005" } } ], "product_groups": [ { "group_id": "CSAFGID-0001", "summary": "Affected Products.", "product_ids": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005" ] } ] }, "vulnerabilities": [ { "cve": "CVE-2019-5161", "cwe": { "id": "CWE-345", "name": "Insufficient Verification of Data Authenticity" }, "notes": [ { "audience": "all", "category": "description", "text": "An exploitable remote code execution vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 versions 03.02.02(14), 03.01.07(13), and 03.00.39(12). A specially crafted XML file will direct the Cloud Connectivity service to download and execute a shell script with root privileges.", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005" ] }, "remediations": [ { "category": "mitigation", "details": "Check the hashes of the Update packet, do not use update files which has a different hash then the original one\nFollow the instructions in WAGOs handbook Cyber Security for Controller\nRestrict network access to the device.\nDo not directly connect the device to the internet\nUse an encrypted VPN connection to the device\nDisable unused TCP/UDP-ports\n\nUse strong passwords for all user accounts, especially for administrative user accounts on the device.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.1, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "temporalScore": 9.1, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005" ] } ], "title": "CVE-2019-5161" } ] } ``` ## [vde-2020-007](https://vulnerability.circl.lu/vuln/vde-2020-007) ```json { "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] }, { "organization": "Cisco Talos", "names": [ "Daniel Patrick DeSantis" ], "summary": "reporting" } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "The Web-Based Management (WBM) of WAGOs programmable logic controller (PLC) is typically used for commissioning and update. The controller is an embedded device which has limited resources. The vulnerability described here takes advantage of this fact.With special crafted requests it is possible to have a denial of service of the WBM.", "title": "Summary" }, { "category": "description", "text": "The default configuration of the web server limits the number of concurrent processes, which can be abused to cause a DoS of the WBM.This vulnerability allows an attacker, who has access to the device, to cause a denial of service of the WBM, by sending special crafted requests.", "title": "Impact" }, { "category": "description", "text": "- Follow the instructions in WAGOs handbook Cyber Security for Controller\n- Restrict network access to the device.\n- Do not directly connect the device to the internet\n\nDue to the limited resources on the embedded device, it is necessary to protect it from unauthorized access such as denial of service attacks.", "title": "Mitigation" } ], "publisher": { "contact_details": "psirt@wago.com", "name": "WAGO GmbH & Co. KG", "namespace": "https://www.wago.com/psirt", "category": "vendor" }, "references": [ { "category": "self", "summary": "VDE-2020-007: WAGO: Web-Based Management Denial of Service - HTML", "url": "https://certvde.com/en/advisories/VDE-2020-007/" }, { "category": "self", "summary": "VDE-2020-007: WAGO: Web-Based Management Denial of Service - CSAF", "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2020/vde-2020-007.json" }, { "category": "external", "summary": "Vendor PSIRT", "url": "https://www.wago.com/psirt" }, { "category": "external", "summary": "CERT@VDE Security Advisories for WAGO GmbH & Co. KG", "url": "https://certvde.com/en/advisories/vendor/wago/" } ], "title": "WAGO: Web-Based Management Denial of Service", "tracking": { "aliases": [ "VDE-2020-007" ], "current_release_date": "2020-03-09T09:10:00.000Z", "generator": { "date": "2025-04-23T08:44:58.268Z", "engine": { "name": "Secvisogram", "version": "2.5.23" } }, "id": "VDE-2020-007", "initial_release_date": "2020-03-09T09:10:00.000Z", "revision_history": [ { "date": "2020-03-09T09:10:00.000Z", "number": "1", "summary": "Initial revision." } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "name": "WAGO", "category": "vendor", "branches": [ { "name": "Hardware", "category": "product_family", "branches": [ { "name": "750-81xx/xxx-xxx (PFC100)", "category": "product_name", "product": { "name": "750-81xx/xxx-xxx (PFC100)", "product_id": "CSAFPID-11001" } }, { "name": "750-82xx/xxx-xxx (PFC200)", "category": "product_name", "product": { "name": "750-82xx/xxx-xxx (PFC200)", "product_id": "CSAFPID-11002" } }, { "name": "762-4xxx", "category": "product_name", "product": { "name": "762-4xxx", "product_id": "CSAFPID-11003" } }, { "name": "762-5xxx", "category": "product_name", "product": { "name": "762-5xxx", "product_id": "CSAFPID-11004" } }, { "name": "762-6xxx", "category": "product_name", "product": { "name": "762-6xxx", "product_id": "CSAFPID-11005" } } ] }, { "name": "Firmware", "category": "product_family", "branches": [ { "name": "vers:all/*", "category": "product_version_range", "product": { "name": "Firmware vers:all/*", "product_id": "CSAFPID-21001" } } ] } ] } ], "product_groups": [ { "group_id": "CSAFGID-0001", "product_ids": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005" ], "summary": "Affected products." } ], "relationships": [ { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11001", "category": "installed_on", "full_product_name": { "name": "Firmware vers:all/* installed on 750-81xx/xxx-xxx (PFC100)", "product_id": "CSAFPID-31001" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11002", "category": "installed_on", "full_product_name": { "name": "Firmware vers:all/* installed on 750-82xx/xxx-xxx (PFC200)", "product_id": "CSAFPID-31002" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11003", "category": "installed_on", "full_product_name": { "name": "Firmware vers:all/* installed on 762-4xxx", "product_id": "CSAFPID-31003" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11004", "category": "installed_on", "full_product_name": { "name": "Firmware vers:all/* installed on 762-5xxx", "product_id": "CSAFPID-31004" } }, { "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11005", "category": "installed_on", "full_product_name": { "name": "Firmware vers:all/* installed on 762-6xxx", "product_id": "CSAFPID-31005" } } ] }, "vulnerabilities": [ { "cve": "CVE-2019-5149", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "description", "text": "The WBM web application on firmwares prior to 03.02.02 and 03.01.07 on the WAGO PFC100 and PFC2000, respectively, runs on a lighttpd web server and makes use of the FastCGI module, which is intended to provide high performance for all Internet applications without the penalties of Web server APIs. However, the default configuration of this module appears to limit the number of concurrent php-cgi processes to two, which can be abused to cause a denial of service of the entire web server. This affects WAGO PFC200 Firmware version 03.00.39(12) and version 03.01.07(13), and WAGO PFC100 Firmware version 03.00.39(12) and version 03.02.02(14).", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005" ] }, "remediations": [ { "category": "mitigation", "group_ids": [ "CSAFGID-0001" ], "details": "- Follow the instructions in WAGOs handbook Cyber Security for Controller\n- Restrict network access to the device.\n- Do not directly connect the device to the internet\n\nDue to the limited resources on the embedded device, it is necessary to protect it from unauthorized access such as denial of service attacks." } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 7.5, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005" ] } ], "title": "CVE-2019-5149" } ] } ``` ## [vde-2019-022](https://vulnerability.circl.lu/vuln/vde-2019-022) ```json { "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] }, { "organization": "Cisco Talos", "names": [ "Kelly Leuschner" ], "summary": "reporting" } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "The reported vulnerabilities allow a remote attacker to change the setting, delete the application, set the device to factory defaults, code execution and to cause a system crash or denial of service.\n\nNote(s)\n\nThe following products are affected by the listed vulnerabilities:\n\nSeries PFC100 (750-81xx/xxx-xxx)\nSeries PFC200 (750-82xx/xxx-xxx)\n\nThe following products are affected by the vulnerability CVE-2019-5078\n\n750-852, 750-831/xxx-xxx, 750-881, 750-880/xxx-xxx, 750-889\n\n750-823, 750-832/xxx-xxx, 750-862, 750-890/xxx-xxx, 750-891", "title": "Summary" }, { "category": "description", "text": "These vulnerabilities allow an attacker to manipulate the settings or disturb the basic function of the device via specially crafted IP packets. This can be potentially used to get control of the device.", "title": "Impact" }, { "category": "description", "text": "Restrict network access to the device.\nDo not directly connect the device to the internet.\nDisable unused TCP/UDP-ports", "title": "Mitigation" }, { "category": "description", "text": "The I/O-Check service protocol is only needed during installation and commissioning, not during normal operations. It is highly recommended to disable the IP-port 6626 after commissioning. This is the easiest and securest way to protect your device for the listed vulnerabilities and for upcoming zero day exploits.\n\nRegardless of the action described above, the following CVEs can be fixed alternatively by a firmware update >= FW 15.\n\nCVE-2019-5073\n\nCVE-2019-5074\n\nCVE-2019-5075\n\nCVE-2019-5079\n\nCVE-2019-5081\n\nCVE-2019-5082", "title": "Remediation" } ], "publisher": { "contact_details": "psirt@wago.com", "name": "WAGO GmbH & Co. KG", "namespace": "https://www.wago.com/psirt", "category": "vendor" }, "references": [ { "category": "self", "summary": "VDE-2019-022: WAGO: Multiple Vulnerabilities in I/O-Check Service in Multiple Devices - HTML", "url": "https://certvde.com/en/advisories/VDE-2019-022/" }, { "category": "self", "summary": "VDE-2019-022: WAGO: Multiple Vulnerabilities in I/O-Check Service in Multiple Devices - CSAF", "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2019/vde-2019-022.json" }, { "category": "external", "summary": "Vendor PSIRT", "url": "https://www.wago.com/psirt" }, { "category": "external", "summary": "CERT@VDE Security Advisories for WAGO GmbH & Co. KG", "url": "https://certvde.com/en/advisories/vendor/wago/" } ], "title": "WAGO: Multiple Vulnerabilities in I/O-Check Service in Multiple Devices", "tracking": { "aliases": [ "VDE-2019-022" ], "current_release_date": "2019-12-16T09:00:00.000Z", "generator": { "date": "2025-04-23T08:38:46.673Z", "engine": { "name": "Secvisogram", "version": "2.5.23" } }, "id": "VDE-2019-022", "initial_release_date": "2019-12-16T09:00:00.000Z", "revision_history": [ { "date": "2019-12-16T09:00:00.000Z", "number": "1", "summary": "Initial revision." } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "name": "WAGO", "category": "vendor", "branches": [ { "name": "Hardware", "category": "product_family", "branches": [ { "name": "750-81xx/xxx-xxx (PFC100)", "category": "product_name", "product": { "name": "750-81xx/xxx-xxx (PFC100)", "product_id": "CSAFPID-11001" } }, { "name": "750-823", "category": "product_name", "product": { "name": "750-823", "product_id": "CSAFPID-11002" } }, { "name": "750-82xx/xxx-xxx (PFC200)", "category": "product_name", "product": { "name": "750-82xx/xxx-xxx (PFC200)", "product_id": "CSAFPID-11003" } }, { "name": "750-831/xxx-xxx", "category": "product_name", "product": { "name": "750-831/xxx-xxx", "product_id": "CSAFPID-11004" } }, { "name": "750-832/xxx-xxx", "category": "product_name", "product": { "name": "750-832/xxx-xxx", "product_id": "CSAFPID-11005" } }, { "name": "750-852", "category": "product_name", "product": { "name": "750-852", "product_id": "CSAFPID-11006" } }, { "name": "750-862", "category": "product_name", "product": { "name": "750-862", "product_id": "CSAFPID-11007" } }, { "name": "750-880/xxx-xxx", "category": "product_name", "product": { "name": "750-880/xxx-xxx", "product_id": "CSAFPID-11008" } }, { "name": "750-881", "category": "product_name", "product": { "name": "750-881", "product_id": "CSAFPID-11009" } }, { "name": "750-889", "category": "product_name", "product": { "name": "750-889", "product_id": "CSAFPID-11010" } }, { "name": "750-890/xxx-xxx", "category": "product_name", "product": { "name": "750-890/xxx-xxx", "product_id": "CSAFPID-11011" } }, { "name": "750-891", "category": "product_name", "product": { "name": "750-891", "product_id": "CSAFPID-11012" } }, { "category": "product_name", "product": { "name": "750-891", "product_id": "CSAFPID-11013" }, "name": "750-891" } ] }, { "name": "Firmware", "category": "product_family", "branches": [ { "name": "= FW 15.\n\nCVE-2019-5073\n\nCVE-2019-5074\n\nCVE-2019-5075\n\nCVE-2019-5079\n\nCVE-2019-5081\n\nCVE-2019-5082", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013" ] } ], "title": "CVE-2019-5082" }, { "cve": "CVE-2019-5081", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "An exploitable heap buffer overflow vulnerability exists in the iocheckd service ''I/O-Chec'' functionality of WAGO PFC 200 Firmware version 03.01.07(13) and 03.00.39(12), and WAGO PFC100 Firmware version 03.00.39(12). A specially crafted set of packets can cause a heap buffer overflow, potentially resulting in code execution. An attacker can send unauthenticated packets to trigger this vulnerability.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013" ] }, "remediations": [ { "category": "mitigation", "details": "Restrict network access to the device.\nDo not directly connect the device to the internet.\nDisable unused TCP/UDP-ports", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "The I/O-Check service protocol is only needed during installation and commissioning, not during normal operations. It is highly recommended to disable the IP-port 6626 after commissioning. This is the easiest and securest way to protect your device for the listed vulnerabilities and for upcoming zero day exploits.\n\nRegardless of the action described above, the following CVEs can be fixed alternatively by a firmware update >= FW 15.\n\nCVE-2019-5073\n\nCVE-2019-5074\n\nCVE-2019-5075\n\nCVE-2019-5079\n\nCVE-2019-5081\n\nCVE-2019-5082", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013" ] } ], "title": "CVE-2019-5081" }, { "cve": "CVE-2019-5079", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "An exploitable heap buffer overflow vulnerability exists in the iocheckd service \"I/O-Check\" functionality of WAGO PFC200 Firmware versions 03.01.07(13) and 03.00.39(12), and WAGO PFC100 Firmware version 03.00.39(12). A specially crafted set of packets can cause a heap buffer overflow, potentially resulting in code execution. An attacker can send unauthenticated packets to trigger this vulnerability.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013" ] }, "remediations": [ { "category": "mitigation", "details": "Restrict network access to the device.\nDo not directly connect the device to the internet.\nDisable unused TCP/UDP-ports", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "The I/O-Check service protocol is only needed during installation and commissioning, not during normal operations. It is highly recommended to disable the IP-port 6626 after commissioning. This is the easiest and securest way to protect your device for the listed vulnerabilities and for upcoming zero day exploits.\n\nRegardless of the action described above, the following CVEs can be fixed alternatively by a firmware update >= FW 15.\n\nCVE-2019-5073\n\nCVE-2019-5074\n\nCVE-2019-5075\n\nCVE-2019-5079\n\nCVE-2019-5081\n\nCVE-2019-5082", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013" ] } ], "title": "CVE-2019-5079" }, { "cve": "CVE-2019-5075", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "An exploitable stack buffer overflow vulnerability exists in the command line utility getcouplerdetails of WAGO PFC200 Firmware versions 03.01.07(13) and 03.00.39(12), and WAGO PFC100 Firmware version 03.00.39(12). A specially crafted set of packets sent to the iocheckd service \"I/O-Check\" can cause a stack buffer overflow in the sub-process getcouplerdetails, resulting in code execution. An attacker can send unauthenticated packets to trigger this vulnerability.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013" ] }, "remediations": [ { "category": "mitigation", "details": "Restrict network access to the device.\nDo not directly connect the device to the internet.\nDisable unused TCP/UDP-ports", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "The I/O-Check service protocol is only needed during installation and commissioning, not during normal operations. It is highly recommended to disable the IP-port 6626 after commissioning. This is the easiest and securest way to protect your device for the listed vulnerabilities and for upcoming zero day exploits.\n\nRegardless of the action described above, the following CVEs can be fixed alternatively by a firmware update >= FW 15.\n\nCVE-2019-5073\n\nCVE-2019-5074\n\nCVE-2019-5075\n\nCVE-2019-5079\n\nCVE-2019-5081\n\nCVE-2019-5082", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013" ] } ], "title": "CVE-2019-5075" }, { "cve": "CVE-2019-5074", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "An exploitable stack buffer overflow vulnerability exists in the iocheckd service ''I/O-Check'' functionality of WAGO PFC200 Firmware version 03.01.07(13), WAGO PFC200 Firmware version 03.00.39(12) and WAGO PFC100 Firmware version 03.00.39(12). A specially crafted set of packets can cause a stack buffer overflow, resulting in code execution. An attacker can send unauthenticated packets to trigger this vulnerability.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013" ] }, "remediations": [ { "category": "mitigation", "details": "Restrict network access to the device.\nDo not directly connect the device to the internet.\nDisable unused TCP/UDP-ports", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "The I/O-Check service protocol is only needed during installation and commissioning, not during normal operations. It is highly recommended to disable the IP-port 6626 after commissioning. This is the easiest and securest way to protect your device for the listed vulnerabilities and for upcoming zero day exploits.\n\nRegardless of the action described above, the following CVEs can be fixed alternatively by a firmware update >= FW 15.\n\nCVE-2019-5073\n\nCVE-2019-5074\n\nCVE-2019-5075\n\nCVE-2019-5079\n\nCVE-2019-5081\n\nCVE-2019-5082", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013" ] } ], "title": "CVE-2019-5074" }, { "cve": "CVE-2019-5073", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "description", "text": "An exploitable information exposure vulnerability exists in the iocheckd service \"I/O-Check\" functionality of WAGO PFC200 Firmware versions 03.01.07(13) and 03.00.39(12), and WAGO PFC100 Firmware version 03.00.39(12). A specially crafted set of packets can cause an external tool to fail, resulting in uninitialized stack data to be copied to the response packet buffer. An attacker can send unauthenticated packets to trigger this vulnerability.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013" ] }, "remediations": [ { "category": "mitigation", "details": "Restrict network access to the device.\nDo not directly connect the device to the internet.\nDisable unused TCP/UDP-ports", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "The I/O-Check service protocol is only needed during installation and commissioning, not during normal operations. It is highly recommended to disable the IP-port 6626 after commissioning. This is the easiest and securest way to protect your device for the listed vulnerabilities and for upcoming zero day exploits.\n\nRegardless of the action described above, the following CVEs can be fixed alternatively by a firmware update >= FW 15.\n\nCVE-2019-5073\n\nCVE-2019-5074\n\nCVE-2019-5075\n\nCVE-2019-5079\n\nCVE-2019-5081\n\nCVE-2019-5082", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "environmentalScore": 5.3, "environmentalSeverity": "MEDIUM", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 5.3, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013" ] } ], "title": "CVE-2019-5073" }, { "cve": "CVE-2019-5078", "cwe": { "id": "CWE-306", "name": "Missing Authentication for Critical Function" }, "notes": [ { "category": "description", "text": "An exploitable denial of service vulnerability exists in the iocheckd service \"I/O-Check\" functionality of WAGO PFC200 Firmware versions 03.01.07(13) and 03.00.39(12), and WAGO PFC100 Firmware version 03.00.39(12). A specially crafted set of packets can cause a denial of service, resulting in the device entering an error state where it ceases all network communications. An attacker can send unauthenticated packets to trigger this vulnerability.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013" ] }, "remediations": [ { "category": "mitigation", "details": "Restrict network access to the device.\nDo not directly connect the device to the internet.\nDisable unused TCP/UDP-ports", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "The I/O-Check service protocol is only needed during installation and commissioning, not during normal operations. It is highly recommended to disable the IP-port 6626 after commissioning. This is the easiest and securest way to protect your device for the listed vulnerabilities and for upcoming zero day exploits.\n\nRegardless of the action described above, the following CVEs can be fixed alternatively by a firmware update >= FW 15.\n\nCVE-2019-5073\n\nCVE-2019-5074\n\nCVE-2019-5075\n\nCVE-2019-5079\n\nCVE-2019-5081\n\nCVE-2019-5082", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "environmentalScore": 9.1, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.1, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012", "CSAFPID-31013" ] } ], "title": "CVE-2019-5078" } ] } ``` ## [vde-2019-013](https://vulnerability.circl.lu/vuln/vde-2019-013) ```json { "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] }, { "organization": "SEC Consult Vulnerability Lab", "summary": "reporting", "names": [ "T. Weber" ] } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "notes": [ { "category": "summary", "text": "Multiple vulnerabilities have been identified in WAGO 852-303, 852-1305 and 852-1505 industrial managed ethernet switches.", "title": "Summary" }, { "category": "description", "text": "(see cve details)", "title": "Impact" }, { "category": "description", "text": "Update your managed switch to the latest firmware:\n\n852-303 (>= V1.2.2.S0)\n\n852-1305 (>= V1.1.6.S0)\n\n852-1505 (>= V1.1.5.S0)\n\n\nFirmwares published on Jun 7, 2019 or later are fixed.\n\nPlease refer to the corresponding manual. ", "title": "Remediation" } ], "publisher": { "contact_details": "psirt@wago.com", "name": "WAGO GmbH & Co. KG", "namespace": "https://www.wago.com/psirt", "category": "vendor" }, "references": [ { "category": "self", "summary": "VDE-2019-013: WAGO: Multiple Vulnerabilities in industrial managed switches - HTML", "url": "https://certvde.com/en/advisories/VDE-2019-013/" }, { "category": "self", "summary": "VDE-2019-013: WAGO: Multiple Vulnerabilities in industrial managed switches - CSAF", "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2019/vde-2019-013.json" }, { "category": "external", "summary": "Vendor PSIRT", "url": "https://www.wago.com/psirt" }, { "category": "external", "summary": "CERT@VDE Security Advisories for WAGO GmbH & Co. KG", "url": "https://certvde.com/en/advisories/vendor/wago/" } ], "title": "WAGO: Multiple Vulnerabilities in industrial managed switches", "tracking": { "aliases": [ "VDE-2019-013" ], "current_release_date": "2019-06-12T10:25:00.000Z", "generator": { "date": "2025-04-23T08:41:04.995Z", "engine": { "name": "Secvisogram", "version": "2.5.23" } }, "id": "VDE-2019-013", "initial_release_date": "2019-06-12T10:25:00.000Z", "revision_history": [ { "date": "2019-06-12T10:25:00.000Z", "number": "1", "summary": "Initial revision." } ], "status": "final", "version": "1" }, "lang": "en-GB" }, "product_tree": { "branches": [ { "name": "WAGO", "category": "vendor", "branches": [ { "name": "Hardware", "category": "product_family", "branches": [ { "name": "852-1305", "category": "product_name", "product": { "name": "852-1305", "product_id": "CSAFPID-11001" } }, { "name": "852-1505", "category": "product_name", "product": { "name": "852-1505", "product_id": "CSAFPID-11002" } }, { "name": "852-303", "category": "product_name", "product": { "name": "852-303", "product_id": "CSAFPID-11003" } } ] }, { "name": "Firmware", "category": "product_family", "branches": [ { "name": "= V1.2.2.S0)\n\n852-1305 (>= V1.1.6.S0)\n\n852-1505 (>= V1.1.5.S0)\n\n\nFirmwares published on Jun 7, 2019 or later are fixed.\n\nPlease refer to the corresponding manual. ", "group_ids": [ "CSAFGID-0001" ] } ], "title": "CVE-2010-3856" }, { "cve": "CVE-2011-2716", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "description", "text": "The DHCP client (udhcpc) in BusyBox before 1.20.0 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in the (1) HOST_NAME, (2) DOMAIN_NAME, (3) NIS_DOMAIN, and (4) TFTP_SERVER_NAME host name options.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update your managed switch to the latest firmware:\n\n852-303 (>= V1.2.2.S0)\n\n852-1305 (>= V1.1.6.S0)\n\n852-1505 (>= V1.1.5.S0)\n\n\nFirmwares published on Jun 7, 2019 or later are fixed.\n\nPlease refer to the corresponding manual. ", "group_ids": [ "CSAFGID-0001" ] } ], "title": "CVE-2011-2716" }, { "cve": "CVE-2012-4412", "notes": [ { "category": "description", "text": "Integer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string, which triggers a heap-based buffer overflow.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update your managed switch to the latest firmware:\n\n852-303 (>= V1.2.2.S0)\n\n852-1305 (>= V1.1.6.S0)\n\n852-1505 (>= V1.1.5.S0)\n\n\nFirmwares published on Jun 7, 2019 or later are fixed.\n\nPlease refer to the corresponding manual. ", "group_ids": [ "CSAFGID-0001" ] } ], "title": "CVE-2012-4412" }, { "cve": "CVE-2014-4043", "cwe": { "id": "CWE-94", "name": "Improper Control of Generation of Code ('Code Injection')" }, "notes": [ { "category": "description", "text": "The posix_spawn_file_actions_addopen function in glibc before 2.20 does not copy its path argument in accordance with the POSIX specification, which allows context-dependent attackers to trigger use-after-free vulnerabilities.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update your managed switch to the latest firmware:\n\n852-303 (>= V1.2.2.S0)\n\n852-1305 (>= V1.1.6.S0)\n\n852-1505 (>= V1.1.5.S0)\n\n\nFirmwares published on Jun 7, 2019 or later are fixed.\n\nPlease refer to the corresponding manual. ", "group_ids": [ "CSAFGID-0001" ] } ], "title": "CVE-2014-4043" }, { "cve": "CVE-2014-9402", "notes": [ { "category": "description", "text": "The nss_dns implementation of getnetbyname in GNU C Library (aka glibc) before 2.21, when the DNS backend in the Name Service Switch configuration is enabled, allows remote attackers to cause a denial of service (infinite loop) by sending a positive answer while a network name is being process.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update your managed switch to the latest firmware:\n\n852-303 (>= V1.2.2.S0)\n\n852-1305 (>= V1.1.6.S0)\n\n852-1505 (>= V1.1.5.S0)\n\n\nFirmwares published on Jun 7, 2019 or later are fixed.\n\nPlease refer to the corresponding manual. ", "group_ids": [ "CSAFGID-0001" ] } ], "title": "CVE-2014-9402" }, { "cve": "CVE-2016-6301", "notes": [ { "category": "description", "text": "The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a communication loop.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update your managed switch to the latest firmware:\n\n852-303 (>= V1.2.2.S0)\n\n852-1305 (>= V1.1.6.S0)\n\n852-1505 (>= V1.1.5.S0)\n\n\nFirmwares published on Jun 7, 2019 or later are fixed.\n\nPlease refer to the corresponding manual. ", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 7.5, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] } ], "title": "CVE-2016-6301" }, { "cve": "CVE-2015-1472", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "notes": [ { "category": "description", "text": "The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during memory allocation, which allows context-dependent attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long line containing wide characters that are improperly handled in a wscanf call.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update your managed switch to the latest firmware:\n\n852-303 (>= V1.2.2.S0)\n\n852-1305 (>= V1.1.6.S0)\n\n852-1505 (>= V1.1.5.S0)\n\n\nFirmwares published on Jun 7, 2019 or later are fixed.\n\nPlease refer to the corresponding manual. ", "group_ids": [ "CSAFGID-0001" ] } ], "title": "CVE-2015-1472" }, { "cve": "CVE-2011-5325", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "notes": [ { "category": "description", "text": "Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update your managed switch to the latest firmware:\n\n852-303 (>= V1.2.2.S0)\n\n852-1305 (>= V1.1.6.S0)\n\n852-1505 (>= V1.1.5.S0)\n\n\nFirmwares published on Jun 7, 2019 or later are fixed.\n\nPlease refer to the corresponding manual. ", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 7.5, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] } ], "title": "CVE-2011-5325" }, { "cve": "CVE-2014-9761", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "notes": [ { "category": "description", "text": "Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long argument to the (1) nan, (2) nanf, or (3) nanl function.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update your managed switch to the latest firmware:\n\n852-303 (>= V1.2.2.S0)\n\n852-1305 (>= V1.1.6.S0)\n\n852-1505 (>= V1.1.5.S0)\n\n\nFirmwares published on Jun 7, 2019 or later are fixed.\n\nPlease refer to the corresponding manual. ", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] } ], "title": "CVE-2014-9761" }, { "cve": "CVE-2014-9984", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "notes": [ { "category": "description", "text": "nscd in the GNU C Library (aka glibc or libc6) before version 2.20 does not correctly compute the size of an internal buffer when processing netgroup requests, possibly leading to an nscd daemon crash or code execution as the user running nscd.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update your managed switch to the latest firmware:\n\n852-303 (>= V1.2.2.S0)\n\n852-1305 (>= V1.1.6.S0)\n\n852-1505 (>= V1.1.5.S0)\n\n\nFirmwares published on Jun 7, 2019 or later are fixed.\n\nPlease refer to the corresponding manual. ", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] } ], "title": "CVE-2014-9984" }, { "cve": "CVE-2015-9261", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "description", "text": "huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash during an unzip operation on a specially crafted ZIP file.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update your managed switch to the latest firmware:\n\n852-303 (>= V1.2.2.S0)\n\n852-1305 (>= V1.1.6.S0)\n\n852-1505 (>= V1.1.5.S0)\n\n\nFirmwares published on Jun 7, 2019 or later are fixed.\n\nPlease refer to the corresponding manual. ", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "environmentalScore": 5.5, "environmentalSeverity": "MEDIUM", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 5.5, "temporalSeverity": "MEDIUM", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] } ], "title": "CVE-2015-9261" }, { "cve": "CVE-2016-2147", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a denial of service (crash) via a malformed RFC1035-encoded domain name, which triggers an out-of-bounds heap write.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update your managed switch to the latest firmware:\n\n852-303 (>= V1.2.2.S0)\n\n852-1305 (>= V1.1.6.S0)\n\n852-1505 (>= V1.1.5.S0)\n\n\nFirmwares published on Jun 7, 2019 or later are fixed.\n\nPlease refer to the corresponding manual. ", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 7.5, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] } ], "title": "CVE-2016-2147" }, { "cve": "CVE-2016-2148", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "notes": [ { "category": "description", "text": "Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vectors involving OPTION_6RD parsing.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update your managed switch to the latest firmware:\n\n852-303 (>= V1.2.2.S0)\n\n852-1305 (>= V1.1.6.S0)\n\n852-1505 (>= V1.1.5.S0)\n\n\nFirmwares published on Jun 7, 2019 or later are fixed.\n\nPlease refer to the corresponding manual. ", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] } ], "title": "CVE-2016-2148" }, { "cve": "CVE-2017-16544", "cwe": { "id": "CWE-94", "name": "Improper Control of Generation of Code ('Code Injection')" }, "notes": [ { "category": "description", "text": "In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update your managed switch to the latest firmware:\n\n852-303 (>= V1.2.2.S0)\n\n852-1305 (>= V1.1.6.S0)\n\n852-1505 (>= V1.1.5.S0)\n\n\nFirmwares published on Jun 7, 2019 or later are fixed.\n\nPlease refer to the corresponding manual. ", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 8.8, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 8.8, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] } ], "title": "CVE-2017-16544" }, { "cve": "CVE-2019-12549", "cwe": { "id": "CWE-798", "name": "Use of Hard-coded Credentials" }, "notes": [ { "category": "description", "text": "WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded private keys for the SSH daemon. The fingerprint of the SSH host key from the corresponding SSH daemon matches the embedded private key.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update your managed switch to the latest firmware:\n\n852-303 (>= V1.2.2.S0)\n\n852-1305 (>= V1.1.6.S0)\n\n852-1505 (>= V1.1.5.S0)\n\n\nFirmwares published on Jun 7, 2019 or later are fixed.\n\nPlease refer to the corresponding manual. ", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] } ], "title": "CVE-2019-12549" }, { "cve": "CVE-2019-12550", "cwe": { "id": "CWE-798", "name": "Use of Hard-coded Credentials" }, "notes": [ { "category": "description", "text": "WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded users and passwords that can be used to login via SSH and TELNET.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update your managed switch to the latest firmware:\n\n852-303 (>= V1.2.2.S0)\n\n852-1305 (>= V1.1.6.S0)\n\n852-1505 (>= V1.1.5.S0)\n\n\nFirmwares published on Jun 7, 2019 or later are fixed.\n\nPlease refer to the corresponding manual. ", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] } ], "title": "CVE-2019-12550" }, { "cve": "CVE-2015-0235", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka \"GHOST.\"", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update your managed switch to the latest firmware:\n\n852-303 (>= V1.2.2.S0)\n\n852-1305 (>= V1.1.6.S0)\n\n852-1505 (>= V1.1.5.S0)\n\n\nFirmwares published on Jun 7, 2019 or later are fixed.\n\nPlease refer to the corresponding manual. ", "group_ids": [ "CSAFGID-0001" ] } ], "title": "CVE-2015-0235" }, { "cve": "CVE-2013-1813", "notes": [ { "category": "description", "text": "util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 permissions for parent directories when creating nested directories under /dev/, which allows local users to have unknown impact and attack vectors.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update your managed switch to the latest firmware:\n\n852-303 (>= V1.2.2.S0)\n\n852-1305 (>= V1.1.6.S0)\n\n852-1505 (>= V1.1.5.S0)\n\n\nFirmwares published on Jun 7, 2019 or later are fixed.\n\nPlease refer to the corresponding manual. ", "group_ids": [ "CSAFGID-0001" ] } ], "title": "CVE-2013-1813" }, { "cve": "CVE-2010-0296", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "description", "text": "The encode_name macro in misc/mntent_r.c in the GNU C Library (aka glibc or libc6) 2.11.1 and earlier, as used by ncpmount and mount.cifs, does not properly handle newline characters in mountpoint names, which allows local users to cause a denial of service (mtab corruption), or possibly modify mount options and gain privileges, via a crafted mount request.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update your managed switch to the latest firmware:\n\n852-303 (>= V1.2.2.S0)\n\n852-1305 (>= V1.1.6.S0)\n\n852-1505 (>= V1.1.5.S0)\n\n\nFirmwares published on Jun 7, 2019 or later are fixed.\n\nPlease refer to the corresponding manual. ", "group_ids": [ "CSAFGID-0001" ] } ], "title": "CVE-2010-0296" } ] } ```