WAGO: Web-Based Management Authentication Vulnerability in WAGO 750-36X and WAGO 750-8XX
The Web-Based Management (WBM) of WAGOs programmable logic controller (PLC) is typically used for administration, commissioning and updates. With special crafted requests it is possible to read and write some special parameters without authentication. This vulnerability is different to advisory SAV-2020-014 / VDE-2020-028
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-34578US | high8.1 | — | ||
This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically constructed requests without authenticat… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (2)
- Mitigation
* Restrict network access to the device. * Do not directly connect the device to the internet. * Disable unused TCP/UDP ports. * Disable web-based management ports 80/443 after the configuration phase
- Behoben
Update the device to the latest FW version.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan