PT-2019-3574 · Wago · Wago 852-1505+2

Publicado 2019-06-13 · Atualizado 2019-06-19 · CVE-2019-12549

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WAGO 852-303 versions before FW06 WAGO 852-1305 versions before FW06 WAGO 852-1505 versions before FW03

Description The issue is related to hardcoded private keys for the SSH daemon in the affected devices. This means that the SSH host key fingerprint matches the embedded private key, potentially allowing unauthorized access. The vulnerability could enable a remote attacker to access the device via SSH.

Recommendations For WAGO 852-303 versions before FW06, update to FW06 or later to resolve the issue. For WAGO 852-1305 versions before FW06, update to FW06 or later to resolve the issue. For WAGO 852-1505 versions before FW03, update to FW03 or later to resolve the issue. As a temporary workaround, consider restricting SSH access to minimize the risk of exploitation.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

BDU:2019-03777

CVE-2019-12549

Produtos afetados

Wago 852-1305

Wago 852-1505

Wago 852-303

Referências · 8

• https://ics-cert.us-cert.gov/advisories/ICSA-19-164-02 · Nota
• https://wago.com/us · Aviso do Fabricante
• https://cert.vde.com/en-us/advisories/vde-2019-013 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-12549 · Nota de Segurança
• https://bdu.fstec.ru/vul/2019-03777 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-12549 · Aviso do Fabricante
• https://exploit.kitploit.com/2019/06/wago-852-industrial-managed-switch.html · Nota
• https://us-cert.gov/ics/advisories/ICSA-19-164-02 · Nota