WAGO: Multiple Products affected by Linux Kernel Vulnerability Dirty Pipe
The Linux kernel starting from 5.8 has a flaw which can lead to privilege escalation for a local user. The kernel is used in several Versions of the FW of several WAGO products. All vulnerable PLCs are listed in chapter 'Affected Products'.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-0847US | high7.8OT kritisch | KEV | ||
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux ker… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (2)
- Mitigation
- Restrict network access to the device. - Use strong passwords - Do not directly connect the device to the internet - Disable unused TCP/UDP-ports
- Behoben
We recommend all affected users to update to the firmware version listed below. ## Series WAGO PFC100/PFC200 and WAGO Compact Controller CC100 | Product | Fixed in Firmware Version | |----------------------|----------------------------| | 750-81xx/xxx-xxx | 03.09.04(21) | | 750-8217/xxx-xxx | 03.09.05(21) | | 750-82xx/xxx-xxx | 03.09.04(21) | | 751-9301 | 03.09.04(21) | ## Series WAGO Touch Panel 600 and WAGO Edge Controller | Product | Fixed in Firmware Version | |----------------------|----------------------------| | 762-4xxx | 03.07.19(19) | | 762-5xxx | 03.07.19(19) | | 762-6xxx | 03.07.19(19) | | 752-8303/8000-002 | 03.07.19(19) |
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan