PT-2020-5126 · Wago · Wago 750-8Xx Series+7

Maxim Rupp · Published 2020-09-30 · Updated 2021-11-17 · CVE-2020-12505

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions WAGO 750-8XX series versions FW07 and prior versions WAGO 750-852 versions FW07 and prior versions WAGO 750-880/xxx-xxx versions FW07 and prior versions WAGO 750-881 versions FW07 and prior versions WAGO 750-831/xxx-xxx versions FW07 and prior versions WAGO 750-882 versions FW07 and prior versions WAGO 750-885/xxx-xxx versions FW07 and prior versions WAGO 750-889 versions FW07 and prior versions

Description The issue is related to improper authentication in the WAGO ethernet controller, allowing a remote attacker to change some special parameters without authentication. This can be exploited by an attacker to modify certain settings.

Recommendations For WAGO 750-8XX series versions FW07 and prior versions, update to a version above FW07 to resolve the issue. For WAGO 750-852 versions FW07 and prior versions, update to a version above FW07 to resolve the issue. For WAGO 750-880/xxx-xxx versions FW07 and prior versions, update to a version above FW07 to resolve the issue. For WAGO 750-881 versions FW07 and prior versions, update to a version above FW07 to resolve the issue. For WAGO 750-831/xxx-xxx versions FW07 and prior versions, update to a version above FW07 to resolve the issue. For WAGO 750-882 versions FW07 and prior versions, update to a version above FW07 to resolve the issue. For WAGO 750-885/xxx-xxx versions FW07 and prior versions, update to a version above FW07 to resolve the issue. For WAGO 750-889 versions FW07 and prior versions, update to a version above FW07 to resolve the issue.

Fix

Improper Authentication

Missing Authentication

Weakness Enumeration

CWE-287

CWE-306

Related Identifiers

BDU:2020-05722

CVE-2020-12505

Affected Products

Wago 750-831

Wago 750-852

Wago 750-880

Wago 750-881

Wago 750-882

Wago 750-885

Wago 750-889

Wago 750-8Xx Series

References · 6

• https://bdu.fstec.ru/vul/2020-05722 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-12505 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12505 · Vendor Advisory
• https://t.me/cibsecurity/14958 · Telegram Post
• https://cert.vde.com/en-us/advisories/vde-2020-027 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-12505 · Note