WAGO: Cloud Connectivity Remote Code Execution Vulnerability
An attacker needs an authorized login with administrative privileges on the device in order to exploit the herein mentioned vulnerability. The weakness allows an attacker which has admin privileges on the device to redirect to his own Azure cloud account and install malicious software with the firmware update functionality.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2019-5161US | critical9.1OT erhöht | — | ||
An exploitable remote code execution vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 versions 03.02.02(14), 03.01.07(13), and 03.00.39(12). A specially… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (1)
- Mitigation
Check the hashes of the Update packet, do not use update files which has a different hash then the original one Follow the instructions in WAGOs handbook Cyber Security for Controller Restrict network access to the device. Do not directly connect the device to the internet Use an encrypted VPN connection to the device Disable unused TCP/UDP-ports Use strong passwords for all user accounts, especially for administrative user accounts on the device.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan