WAGO: Series 750-3x/-8x prone to MODBUS server DoS
An unauthenticated attacker with network access to port 502/TCP of the target device can cause a denial-of-service condition by sending multiple specially crafted packets. The MODBUS server does not properly release memory resources that were reserved for incomplete connection attempts by MODBUS clients. This could allow a remote attacker to generate a denial of service condition on devices that incorporate a vulnerable version of the MODBUS server.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-1150US | — | — | ||
Uncontrolled resource consumption in Series WAGO 750-3x/-8x products may allow an unauthenticated remote attacker to DoS the MODBUS server with specially crafted packets. | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (2)
- Mitigation
In case no MODBUS communication is needed the MODBUS-Server should be deactivated in the product settings of the web-based management. As general security measures WAGO strongly recommends: 1. Use general security best practices to protect systems from local and network attacks. 2. Do not allow direct access to the device from untrusted networks. 3. Update to the latest firmware according to the table in chapter solutions. 4. Industrial control systems (ICS) should not be directly accessible from the Internet, but should be protected by consistently applying the defense-in-depth strategy. The BSI provides general information on securing ICS in the ICS Compendium (www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/ICS/ICS-Security_compendium.pdf).
- Behoben
We recommend all affected users to update to the firmware version listed below: ### Series WAGO 750-3x/-8x | Article Number | Fixed in Firmware Version | |----------------------|----------------------------------------| | 750-332 | FW11 after BACnet certification | | 750-362/xxx-xxx | FW11 Q3/2023 | | 750-363/xxx-xxx | FW11 Q3/2023 | | 750-364/xxx-xxx | FW11 Q3/2023 | | 750-365/xxx-xxx | FW11 Q3/2023 | | 750-823 | FW11 Q3/2023 | | 750-832/xxx-xxx | FW11 after BACnet certification | | 750-862 | FW11 Q1/2023 | | 750-890/xxx-xxx | FW11 Q3/2023 | | 750-891 | FW11 Q3/2023 | | 750-893 | FW11 Q3/2023 |
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan