WAGO: Command Injection Vulnerability in I/O-Check Service of multiple products
The reported vulnerability allows an attacker who has network access to the device to execute code with specially crafted packets.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-12522US | critical9.8 | — | ||
The reported vulnerability allows an attacker who has network access to the device to execute code with specially crafted packets in WAGO Series PFC 100 (750-81xx/xxx-xxx), Series… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (2)
- Mitigation
* Disable I/O-Check service * Restrict network access to the device. * Do not directly connect the device to the internet.
- Behoben
The I/O-Check service protocol is only needed during installation and commissioning, not during normal operations. It is highly recommended to disable the I/O-Check service after commissioning. This is the easiest and securest way to protect your device from the listed vulnerabilities. Regardless to the action described above, the vulnerability has been fixed in FW11, released in December 2017.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan