PT-2019-3767 · Wago · Wago Series 750-88X+1

Wht · Published 2019-04-12 · Updated 2020-10-01 · CVE-2019-10712

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WAGO Series 750-88x versions 750-330, 750-352, 750-829, 750-831, 750-852, 750-880, 750-881, 750-882, 750-884, 750-885, 750-889 WAGO Series 750-87x versions 750-830, 750-849, 750-871, 750-872, 750-873

Description The issue exists due to hardcoded registration data in the Web-GUI component of the programmable logic controllers' firmware. This allows a remote attacker to modify settings. The Web-GUI on affected devices has undocumented service access.

Recommendations For WAGO Series 750-88x devices, consider disabling the Web-GUI service until a patch is available. For WAGO Series 750-87x devices, restrict access to the Web-GUI component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2019-04027

CVE-2019-10712

Affected Products

Wago Series 750-87X

Wago Series 750-88X

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2019-10712 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10712 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04027 · Security Note
• https://lists.apache.org/thread.html/ra37700b842790883b9082e6b281fb7596f571b13078a4856cd38f2c2%40%3Ccommits.cassandra.apache.org%3E · Note
• https://lists.apache.org/thread.html/rb47911c179c9f3e8ea3f134b5645e63cd20c6fc63bd0b43ab5864bd1%40%3Ccommits.cassandra.apache.org%3E · Note
• https://lists.apache.org/thread.html/r25e25973e9577c62fd0221b4b52990851adf11cbe33036bd67d4b13d%40%3Ccommits.cassandra.apache.org%3E · Note
• https://lists.apache.org/thread.html/r386966780034aadee69ffd82d44555117c9339545b9ce990fe490a3e%40%3Ccommits.cassandra.apache.org%3E · Note
• https://cert.vde.com/de-de/advisories/vde-2019-008 · Note
• https://lists.apache.org/thread.html/r37eb6579fa0bf94a72b6c978e2fee96f68a2b1b3ac1b1ce60aee86cf%40%3Ccommits.cassandra.apache.org%3E · Note
• https://wago.com/de/download/public/Sicherheitshinweis-SA-SYS-2019-001/SA-SYS-2019-001.pdf · Note
• http://securityfocus.com/bid/108482 · Note
• https://lists.apache.org/thread.html/r80e8882c86c9c17a57396a5ef7c4f08878d629a0291243411be0de3a%40%3Ccommits.cassandra.apache.org%3E · Note
• https://lists.apache.org/thread.html/r0066c1e862613de402fee04e81cbe00bcd64b64a2711beb9a13c3b25%40%3Ccommits.cassandra.apache.org%3E · Note
• https://securityfocus.com/bid/108482 · Note