PT-2020-5120 · Wago · Wago 750-8Xx Series+7

Maxim Rupp · Published 2020-09-30 · Updated 2021-11-17 · CVE-2020-12506

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions WAGO 750-8XX series versions FW03 and prior versions WAGO 750-362 versions FW03 and prior versions WAGO 750-363 versions FW03 and prior versions WAGO 750-823 versions FW03 and prior versions WAGO 750-832/xxx-xxx versions FW03 and prior versions WAGO 750-862 versions FW03 and prior versions WAGO 750-891 versions FW03 and prior versions WAGO 750-890/xxx-xxx versions FW03 and prior versions

Description The issue is related to an Improper Authentication vulnerability in the WAGO 750-8XX series, which allows an attacker to change the settings of the devices by sending specifically constructed requests without authentication. This can be done remotely.

Recommendations For WAGO 750-8XX series versions FW03 and prior versions, consider disabling remote access until a patch is available. For WAGO 750-362 versions FW03 and prior versions, restrict access to the device settings to minimize the risk of exploitation. For WAGO 750-363 versions FW03 and prior versions, avoid using the device until a fixed version is released. For WAGO 750-823 versions FW03 and prior versions, limit the ability to send specifically constructed requests to the device. For WAGO 750-832/xxx-xxx versions FW03 and prior versions, consider implementing additional authentication measures. For WAGO 750-862 versions FW03 and prior versions, restrict access to the device settings. For WAGO 750-891 versions FW03 and prior versions, avoid using the device until a fixed version is released. For WAGO 750-890/xxx-xxx versions FW03 and prior versions, limit the ability to send specifically constructed requests to the device. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Missing Authentication

Weakness Enumeration

CWE-287

CWE-306

Related Identifiers

BDU:2020-05716

CVE-2020-12506

Affected Products

Wago 750-362

Wago 750-363

Wago 750-823

Wago 750-832

Wago 750-862

Wago 750-890

Wago 750-891

Wago 750-8Xx Series

References · 6

• https://bdu.fstec.ru/vul/2020-05716 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12506 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12506 · Security Note
• https://cert.vde.com/en-us/advisories/vde-2020-028 · Note
• https://t.me/cibsecurity/14957 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-12506 · Note