PT-2019-3574 · Wago · Wago 852-1505+2

Published 2019-06-13 · Updated 2019-06-19 · CVE-2019-12549

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WAGO 852-303 versions before FW06 WAGO 852-1305 versions before FW06 WAGO 852-1505 versions before FW03

Description The issue is related to hardcoded private keys for the SSH daemon in the affected devices. This means that the SSH host key fingerprint matches the embedded private key, potentially allowing unauthorized access. The vulnerability could enable a remote attacker to access the device via SSH.

Recommendations For WAGO 852-303 versions before FW06, update to FW06 or later to resolve the issue. For WAGO 852-1305 versions before FW06, update to FW06 or later to resolve the issue. For WAGO 852-1505 versions before FW03, update to FW03 or later to resolve the issue. As a temporary workaround, consider restricting SSH access to minimize the risk of exploitation.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2019-03777

CVE-2019-12549

Affected Products

Wago 852-1305

Wago 852-1505

Wago 852-303

References · 8

• https://wago.com/us · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12549 · Security Note
• https://bdu.fstec.ru/vul/2019-03777 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12549 · Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-19-164-02 · Note
• https://cert.vde.com/en-us/advisories/vde-2019-013 · Note
• https://exploit.kitploit.com/2019/06/wago-852-industrial-managed-switch.html · Note
• https://us-cert.gov/ics/advisories/ICSA-19-164-02 · Note