ICS-Advisories

Risk Evaluation

The mb24api endpoint reachable when connected via VPN is missing authentication for sensitive functions. This can lead to information disclosure of user- and device names and to DoS.

Zusammenfassung der Gegenmaßnahmen

Update to latest version: 2.18.0

Risk Evaluation

Two vulnerabilities in mbCONNECT24/mymbCONNECT24 can lead to user enumeration an password bypass.

Zusammenfassung der Gegenmaßnahmen

Update to latest version: 2.16.5

Risk Evaluation

The mb24api endpoint reachable when connected via VPN is missing authentication for sensitive functions. This can lead to information disclosure of user- and device names and to DoS.

Zusammenfassung der Gegenmaßnahmen

Update to latest version: 2.18.0

Risk Evaluation

Two vulnerabilities in myREX24/myREX24.virtual can lead to user enumeration an password bypass.

Zusammenfassung der Gegenmaßnahmen

Update to latest version: 2.16.5

Risk Evaluation

The Festo controller CECC-X-M1 product family in multiple versions are affected by a preauthentication command injection vulnerability. Update A, 2022-07-05 Remediation has been updated. Fixed firmwares are now available.

Zusammenfassung der Gegenmaßnahmen

Please update to firmware versions as described below: | Product | Product Details | Fixed in version | |-----------------------------|-----------------------------------------------------------|------------------| | Controller CECC-X-M1 | Festo:Partnumber:4407603 Festo:Ordercode:CECC-X-M1 | 3.8.18 | | Controller CECC-X-M1 | Festo:Partnumber:8124922 Festo:Ordercode:CECC-X-M1 | 4.0.18 | | Controller CECC-X-M1-MV | Festo:Partnumber:4407605 Festo:Ordercode:CECC-X-M1-MV | 3.8.18 | | Controller CECC-X-M1-MV | Festo:Partnumber:8124923 Festo:Ordercode:CECC-X-M1-MV | 4.0.18 | | Controller CECC-X-M1-MVS1 | Festo:Partnumber:4407606 Festo:Ordercode:CECC-X-M1-MV-S1 | 3.8.18 | | Controller CECC-X-M1-MVS1 | Festo:Partnumber:8124924 Festo:Ordercode:CECC-X-M1-MV-S1 | 4.0.18 | | Controller CECC-X-M1-YYJKP | Festo:Partnumber:4803891 Festo:Ordercode:CECC-X-M1-YYJKP | 3.8.18 | | Controller CECC-X-M1-YSL1 | Festo:Partnumber:8082793 Festo:Ordercode:CECC-X-M1-YS-L1 | 3.8.18 | | Controller CECC-X-M1-YSL2 | Festo:Partnumber:8082794 Festo:Ordercode:CECC-X-M1-YS-L2 | 3.8.18 | | Servo Press Kit YJKP | Festo:Partnumber:8077950 Festo:Ordercode:YJKP | 3.8.18 | | Servo Press Kit YJKP | Festo:Partnumber:8058596 Festo:Ordercode:YJKP | 3.8.18 |

Risk Evaluation

The base ctrlX OS apps Device Admin and Solutions contain multiple vulnerabilities. In a worst case scenario, a remote authenticated (low-privileged) attacker might be able to execute arbitrary OS commands running with higher privileges.

Zusammenfassung der Gegenmaßnahmen

Update to Solutions 2.6.1 which is available in the WAGO Download center.

Risk Evaluation

Two issues have been discovered in mymbCONNECT24 and mbCONNECT24 in all versionsincluding V2.8.0. Updated affected versions (and solution) due to incomplete fixes in previous versions

Zusammenfassung der Gegenmaßnahmen

CVE-2021-34575: Update to 2.9.0 CVE-2021-34574: Update to 2.12.1

Risk Evaluation

The CODESYS Key USB dongle, which is based on WIBU CodeMeter technology, is affected by a physical side-channel vulnerability.

Zusammenfassung der Gegenmaßnahmen

Update the CODESYS Key firmware to version 4.52. Updating the firmware also protects the future usage of additional CODESYS Key features by the CODESYS software and general usage by other software. The update can be installed, for example, via the CodeMeter Control Center.

Risk Evaluation

A low privileged attacker with physical access to a controller, that supports removable media and is running a CODESYS Control runtime system, can exploit the insufficient path validation by connecting removable media with a file system supporting symbolic links. This could allow the attacker to bypass SysFile restrictions and gain unauthorized access to the entire file system.

Zusammenfassung der Gegenmaßnahmen

Regardless of the vulnerability described here, CODESYS GmbH recommends that physical access to the controller should only be granted to authorized persons. Especially in the case of productive control systems, physical manipulation of the controller can affect the controlled machine or process. This generally recommended restriction of access also reduces the attack surface for this vulnerability, as its exploitation requires physical access. To exploit this vulnerability, a successful login to the affected product is required. The online user management therefore protects from exploiting this security vulnerability. CODESYS GmbH strongly recommends using the online user management, which is enforced by default. This not only prevents from accessing the file system with malicious symbolic links, but also suppresses modifying the PLC application, or starting, stopping, debugging or other actions on a known working PLC application that could potentially disrupt a machine or system. To fully mitigate this vulnerability, system administrators can restrict the use of removable media to devices that do not support symbolic links, such as FAT16 or FAT32. Since these file systems lack symbolic link functionality, this effectively prevents any symbolic link-based attacks. Alternatively, remove PlaceHolderFilePath settings from the CODESYS Control configuration file, which point to removable media such as: [SysFile] PlaceholderFilePath.1=/media/usb, $USB$

Risk Evaluation

Several WAGO Firmwares are vulnerable to a to a remote attack which allows to bypass the integrity check through OpenSSH. This called Terrapin attack occurs because of mishandled handshake phase.

Zusammenfassung der Gegenmaßnahmen

A fix for the affected Firmwares will be provided with the following firmware versions: - FW22, Patch 2 installed on 750-810x - FW22, Patch 2 installed on 750-821x - FW22, Patch 2 installed on 762-4x0x - FW22, Patch 2 installed on 762-5x0x - FW22, Patch 2 installed on 762-6x0x - FW22, Patch 2 installed on 752-8303 - FW27 installed on 750-811x - FW27 installed on 750-821x - FW27 installed on 751-9301 - FW27 installed on 751-9401 - FW27 installed on 762-4x0x - FW27 installed on 762-5x0x - FW27 installed on 762-6x0x - FW27 installed on 752-8303 - Custom Firmware 03.03.08 (80) installed on 750-820x - Custom Firmware 04.03.03 (72) installed on 751-9301 - Custom Firmware 04.03.03 (72) installed on 751-9401 - Custom Firmware 04.04.03 (70) installed on 750-821x

Risk Evaluation

Several Pilz software products do not properly check pathnames contained in archives. An attacker can utilise this vulnerability to write arbitrary files, potentially leading to code execution.

Zusammenfassung der Gegenmaßnahmen

Please visit the Pilz Shop (www.pilz.com/en-INT/eshop) to check for the fixed version

Risk Evaluation

By tricking clients of the mentioned products into contacting malicious OPC UA servers and thereby acting as OPC UA clients, a crash of the component can be provoked.

Zusammenfassung der Gegenmaßnahmen

Have your applications configured to use other than SecurityMode=None for all OPC UA connections. Avoid that these connect to an unknown OPC UA server with SecurityMode=None. In particular, avoid that your applications connect to servers which they discover via mDNS, a Local Discovery Server (LDS), an untrusted Global Discovery Server (GDS) or even trusted GDS using SecurityMode=none. Especially in the latter case an adversary might be able to apply the 'man in the middle' pattern to attack the connection and inject a bad message which triggers the vulnerability.

Risk Evaluation

Under certain circumstances, opening a specially crafted 7-zip package can exploit an integer underflow vulnerability in 7-zip versions up to and including 22.x This vulnerability allows for a remote code execution, resulting in unauthorized (remote) access to, change of data or disruption of the whole service.

Zusammenfassung der Gegenmaßnahmen

Please download the replacement tool. For additional questions please contact your TRUMPF Service with the PR number 501709.

Risk Evaluation

The Year 2038 Problem affects systems using a 32-bit integer to represent time as the number of seconds since January 1st, 1970. On January 19, 2038, at 03:14:07 UTC, the time value will exceed the maximum for a 32-bit integer, causing an overflow and resetting it to a negative number.

Zusammenfassung der Gegenmaßnahmen

Due to the low impact of the vulnerability and the fact that only the logging functionality is affected, there is no fix planned.

Risk Evaluation

The Lenze VPN client is vulnerable to a Local Privilege Escalation to root/SYSTEM by executing a configuration file which can be controlled by a non-privileged user. This occurs through a race condition exploit, where an attacker can overwrite the temporary OpenVPN configuration file located in a world-writable directory. By injecting malicious commands into the configuration file prior to its execution by the VPN client, an attacker can trigger arbitrary code execution with root/system privileges when a VPN connection is initiated. The vulnerability has been remediated in the version 1.4.4 of the Lenze VPN client. Due to some further developments and completion of the functional scope, it is recommended to update the firmware of the x500 IoT Gateway devices immediately, regardless of the current security vulnerability in the VPN client.

Zusammenfassung der Gegenmaßnahmen

Obtain the updated VPN software (version >= 1.4.4) from https://cloud.lenze.digital/fleet-manager/tools and run the installer on a windows and macOS system or run the following commands in an linux system: tar -xzf vpn_client_x64.tar.gz cd vpn_client_x64 sudo ./install

Risk Evaluation

An unauthenticated user can exploit a vulnerability (CVE-2018-12981) to inject code in the WBM via reflected cross-site scripting (XSS), if he is able trick a user to open a special crafted web site. This could allow an attacker to execute code in the context of the user and execute arbitrary commands with restriction to the permissions of the user. Authenticated users can use a vulnerability to inject code in the WBM via persistent cross-site scripting (XSS) via special crafted requests which will be rendered and/or executed in the browser. Authenticated WBM users can transfer arbitrary files to different file system locations (CVE- 2018-12980) to which the web server has the required permissions and partially allowing replacing existing files due weak file permissions (CVE-2018-12979) which can result in an authentication bypass.

Zusammenfassung der Gegenmaßnahmen

Update your device to the latest firmware (FW 02). In case this is not feasible limit the access to trusted users and devices. For details on how to obtain the new firmware, please send a request by email to support@wago.com.

Risk Evaluation

The firmware update package (WUP) is not signed entirely. The used password offers no additional security, it is just meant to protect from unintentional modifications of the WUP file. Thus only the integrity of the signed firmware part (rauc file) is protected against intended manipulation. An attacker could manipulate the WUP file in a way that additional files with potentially malicious content are added to the WUP file. In case an authorized user that issues a firmware update could be tricked into installing this manipulated WUP file onto the device, the potentially malicious files would also be copied and installed on to the device and executed with elevated privileges.

Zusammenfassung der Gegenmaßnahmen

Execute FW-Update only as user 'admin'.

Risk Evaluation

An attacker needs an authorized login on the device in order to exploit the herein mentioned vulnerabilities. The reported vulnerabilities allow a local attacker with valid login credentials who is able to create files on the device to change the devices settings, e.g. default gateway address, time server etc. and potentially execute code.

Zusammenfassung der Gegenmaßnahmen

* Disable I/O-Check service. * Restrict network access to the device. * Do not directly connect the device to the internet. * Disable unused TCP/UDP-ports.

Risk Evaluation

Multiple vulnerabilities were reported in CODESYS 2.3 Runtime. The CODESYS 2.3 Runtime is an essential component in several WAGO PLC's.

Zusammenfassung der Gegenmaßnahmen

If an immediate firmware update is not possible, the WLAN on the unit can also be switched off as a precautionary measure.

Risk Evaluation

A Denial-of-Service Vulnerability was reported in CODESYS 2.3 Runtime. The CODESYS 2.3 Runtime is an essential component in several WAGO PLC's. All vulnerable PLCs are listed in chapter 'Affected Products'.

Zusammenfassung der Gegenmaßnahmen

1. Use general security best practices to protect systems from local and network attacks. 2. Do not allow direct access to the device from untrusted networks. 3. Update to the latest firmware according to the table in chapter solutions. 4. Disable the CODESYS 2.3 port 2455.

Risk Evaluation

Apache Log4j is used for logging events in WAGO Smart Script in Version 4.2 and higher. Events logged by Log4j can contain JNDI references. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. Additionally, Log4j does not protect from self-referential lookups, which can lead to Denial of Service. UPDATE A1/2: Affected versions: CVE-2021-44228 and CVE-2021-45046: WAGO Smart Script >= Version 4.2 and < Version 4.8.1.3 CVE-2021-45105: WAGO Smart Script >= Version 4.2 and < Version 4.8.1.4 CVE-2021-44832 WAGO Smart Script >= Version 4.2 and < Version 4.8.1.5 END UPDATE A1/2

Zusammenfassung der Gegenmaßnahmen

Do not use projects from untrusted sources. For further impact information and risk mitigation, see the recommendations of the Apache Foundation https://logging.apache.org/log4j/2.x/security.html Bundesamt für Sicherheit in der Informationstechnik (BSI) https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2021/211211_log4Shell_WarnstufeRot.html

Risk Evaluation

A vulnerability is reported in WIBU-SYSTEMS Codemeter. WIBU-SYSTEMS Codemeter is installed by default during e!COCKPIT and WAGO-I/O-Pro (CODESYS 2.3) installations. All currently existing e!COCKPIT installation bundles and WAGO-I/O-Pro (CODESYS 2.3) installation bundles are affected with vulnerable versions of WIBU-SYSTEMS Codemeter.

Zusammenfassung der Gegenmaßnahmen

Mitigation Use general security best practices to protect systems from local and network attacks. Disable the container type 'Mass Storage' in CodeMeter via the Windows Registry.

Risk Evaluation

The Linux kernel starting from 5.8 has a flaw which can lead to privilege escalation for a local user. The kernel is used in several Versions of the FW of several WAGO products. All vulnerable PLCs are listed in chapter 'Affected Products'.

Zusammenfassung der Gegenmaßnahmen

- Restrict network access to the device. - Use strong passwords - Do not directly connect the device to the internet - Disable unused TCP/UDP-ports

Risk Evaluation

The 'legal information' plugin of web-based-management contained a vulnerability which allowed execution of arbitrary commands with privileges of www user. UPDATE A 15.06.2023 : Removed PFC100 with FW23 as affected product and from solution PFC200 with FW23 is only affected on 750-821x/xxx-xxx Renamed "FW22 Patch 1" to "FW22 SP1" to match the versions of the download portal

Zusammenfassung der Gegenmaßnahmen

As general security measures strongly WAGO recommends: Use general security best practices to protect systems from local and network attacks. Do not allow direct access to the device from untrusted networks. Update to the latest firmware according to the table in chapter solutions. Industrial control systems (ICS) should not be directly accessible from the Internet, but should be protected by consistently applying the defense-in-depth strategy. The BSI provides general information on securing ICS in the ICS Compendium (https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/ICS/ICS-Security_compendium.pdf).

Risk Evaluation

Multiple WAGO devices are prone to vulnerabilites in the used CODESYS V3 framework.

Zusammenfassung der Gegenmaßnahmen

Vulnerabilities of CODESYS Advisory 2023-02:• Please make sure that the 'port authentication' option in the web-based management is activated. In this way none of the vulnerabilities can be exploited by unauthenticated users.• Please change the default admin password. Vulnerability of CODESYS Advisory 2023-03:• This vulnerability exists in the CODESYS programming service which is needed for commission only. Deactivate the CODESYS programming port in the web-based management if you do not need the service. In addition to the mitigation hints CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits: Use controllers and devices only in a protected environment to minimize network exposure and ensure they are not accessible from outside. Use firewalls to protect and separate the control system network from other networks. Use VPN (Virtual Private Networks) tunnels if remote access is required. Activate and apply user management and password features. Use encrypted communication links. Limit the access to both development and control system by physical means, operating system features, etc. Protect both development and control system by using up to date virus detection solutions. For further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html