WAGO: Authentication Bypass Vulnerability in WAGO 750-36X and WAGO 750-8XX Version <= FW03
The Web-Based Management (WBM) of WAGOs programmable logic controller (PLC) is typically used for administration, commissioning and updates. With special crafted requests it is possible to change some special parameters without authentication.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-12506US | medium6.4OT elevated | — | ||
Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW03 allows an attacker to change the settings of the devices by sending specifically constructed re… | ||||
references
External citations — patches, advisories, analysis.
remediations (2)
- Mitigation
* Restrict network access to the device. * Do not directly connect the device to the internet. * Disable unused TCP/UDP ports. * Disable web-based management ports 80/443 after the configuration phase
- Fixed
Update affected devices to version >FW03
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan