CVE-2018-5459
highPriorität · verfolgen · 40EPSS 0.027 · 86. PerzentilEUUSEPSS · bewertet 2026-10-27
An Improper Authentication issue was discovered in WAGO PFC200 Series 3S CoDeSys Runtime versions 2.3.X and 2.4.X. An attacker can execute different unauthenticated remote operations because of the CoDeSys Runtime application, which is available via network by default on Port 2455. An attacker could execute some unauthenticated commands such as reading, writing, or deleting arbitrary files, or manipulate the PLC application during runtime by sending specially-crafted TCP packets to Port 2455.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- Behoben750-8202cisa_csaf_ot
WAGO released a security patch with FW11 available at:
http://global.wago.com/media/2_products/security/Sec-Advisory_CoDeSys.pdf - Behoben750-8202/025-000cisa_csaf_ot
WAGO released a security patch with FW11 available at:
http://global.wago.com/media/2_products/security/Sec-Advisory_CoDeSys.pdf - Behoben750-8202/025-001cisa_csaf_ot
WAGO released a security patch with FW11 available at:
http://global.wago.com/media/2_products/security/Sec-Advisory_CoDeSys.pdf - Behoben750-8202/025-002cisa_csaf_ot
WAGO released a security patch with FW11 available at:
http://global.wago.com/media/2_products/security/Sec-Advisory_CoDeSys.pdf - Behoben750-8202/040-001cisa_csaf_ot
WAGO released a security patch with FW11 available at:
http://global.wago.com/media/2_products/security/Sec-Advisory_CoDeSys.pdf - Behoben750-8203cisa_csaf_ot
WAGO released a security patch with FW11 available at:
http://global.wago.com/media/2_products/security/Sec-Advisory_CoDeSys.pdf - Behoben750-8203/025-000cisa_csaf_ot
WAGO released a security patch with FW11 available at:
http://global.wago.com/media/2_products/security/Sec-Advisory_CoDeSys.pdf - Behoben750-8204cisa_csaf_ot
WAGO released a security patch with FW11 available at:
http://global.wago.com/media/2_products/security/Sec-Advisory_CoDeSys.pdf - Behoben750-8204/025-000cisa_csaf_ot
WAGO released a security patch with FW11 available at:
http://global.wago.com/media/2_products/security/Sec-Advisory_CoDeSys.pdf - Behoben750-8206cisa_csaf_ot
WAGO released a security patch with FW11 available at:
http://global.wago.com/media/2_products/security/Sec-Advisory_CoDeSys.pdf - Behoben750-8206/025-000cisa_csaf_ot
WAGO released a security patch with FW11 available at:
http://global.wago.com/media/2_products/security/Sec-Advisory_CoDeSys.pdf - Behoben750-8206/025-001cisa_csaf_ot
WAGO released a security patch with FW11 available at:
http://global.wago.com/media/2_products/security/Sec-Advisory_CoDeSys.pdf - Behoben750-8207cisa_csaf_ot
WAGO released a security patch with FW11 available at:
http://global.wago.com/media/2_products/security/Sec-Advisory_CoDeSys.pdf - Behoben750-8207/025-000cisa_csaf_ot
WAGO released a security patch with FW11 available at:
http://global.wago.com/media/2_products/security/Sec-Advisory_CoDeSys.pdf - Behoben750-8207/025-001cisa_csaf_ot
WAGO released a security patch with FW11 available at:
http://global.wago.com/media/2_products/security/Sec-Advisory_CoDeSys.pdf - Behoben750-8208cisa_csaf_ot
WAGO released a security patch with FW11 available at:
http://global.wago.com/media/2_products/security/Sec-Advisory_CoDeSys.pdf - Behoben750-8208/025-000cisa_csaf_ot
WAGO released a security patch with FW11 available at:
http://global.wago.com/media/2_products/security/Sec-Advisory_CoDeSys.pdf - BehobenCoDeSyscisa_csaf_ot
WAGO released a security patch with FW11 available at:
http://global.wago.com/media/2_products/security/Sec-Advisory_CoDeSys.pdf
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 7.5–9.8
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (39)
Betroffene Produkte und Versionsbereiche.
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- ICSA-18-044-01WAGO PFC200 Series2018-02-13icsa · cisa_csaf_otUS
ATTENTION: Remotely exploitable/low skill level to exploit. Public exploits are available.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (4)
Externe Belege — Patches, Meldungen, Analysen.
- http://global.wago.com/media/2_products/security/Sec-Advisory_CoDeSys.pdfPatchcnnvd
- https://ics-cert.us-cert.gov/advisories/ICSA-18-044-01cnnvd
- https://ics-cert.us-cert.gov/advisories/ICSA-18-044-01enisa_euvd
- https://ics-cert.us-cert.gov/advisories/ICSA-18-044-01Third Party AdvisoryUS Government Resourcenvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan