ICS-Advisories

Risk Evaluation

Multiple WAGO devices are affected by CODESYS Control vulnerabilities. The affected WAGO firmware versions are <4.10.0 (FW32) and <4.10.0 (70).

Zusammenfassung der Gegenmaßnahmen

Update to Firmware version 4.10.0 (FW32) or higher. For the latest Custom Firmware please contact the WAGO support.

Risk Evaluation

A vulnerability in the authentication and credential recovery process may allow an unauthenticated attacker to bypass intended verification controls during password reset operations. By exploiting this weakness, an attacker could reset credentials for arbitrary user accounts and gain unauthorized access without possessing valid authentication credentials.

Zusammenfassung der Gegenmaßnahmen

The vulnerability was remediated in the Building Cloud Service on August 26, and as the service is centrally managed and updated automatically, no customer action is required to apply the security fix. Customers are advised to review user account activity and verify that no passwords have been changed unexpectedly prior to remediation.

Risk Evaluation

Critical vulnerabilities in the PHP runtime may allow a remote attacker to execute arbitrary code by exploiting weaknesses in PHP's internal memory and request handling mechanisms. Under specific conditions, specially crafted web requests can trigger unexpected behavior that could compromise the affected web server process. WAGO controllers with the integrated web server enabled and running an affected PHP version are exposed to these vulnerabilities.

Zusammenfassung der Gegenmaßnahmen

Update the device to Firmware Version 4.10.4 (FW32) or later. Until FW32 is available, customers using Firmware Version 4.9.1 (FW31) should install the corresponding IPK security patch, which is available through the WAGO Download Center.

Risk Evaluation

Multiple WAGO devices are affected by a vulnerability in the dynamic creation of BACnet File Objects. The object name is used as a file path without sufficient validation and is not restricted to the intended directory, so relative paths can be used to reach files elsewhere in the file system.

Zusammenfassung der Gegenmaßnahmen

Update to Firmware version 4.8.9 (FW30) or higher. For the latest custom Firmware please contact the WAGO support.

Risk Evaluation

The Year 2038 Problem affects systems using a 32-bit integer to represent time as the number of seconds since January 1, 1970. On January 19, 2038, at 03:14:07 UTC, the time value will exceed the maximum for a 32-bit integer, causing an overflow and resetting it to a negative number.

Zusammenfassung der Gegenmaßnahmen

Update to Firmware 4.10.0 (FW32) or higher. For the latest Custom Firmware, please contact the WAGO support.

Risk Evaluation

Certain devices in the WAGO System I/O Field series enable an internal diagnostic capability during the initial stages of system startup. This behavior, which is not part of the publicly documented feature set, briefly allows access to system functions before the main operating environment becomes fully active. Under specific conditions, this could permit interactions with system components that are normally protected during regular operation.

Zusammenfassung der Gegenmaßnahmen

Update to the listed fixed versions of the affected firmwares: | Fixed Version | Product Name | | ------------- | ------------------------------------ | | 1.2.1.100 | I/O System Field 0765-110x/0100-0000 | | 1.2.7.100 | I/O System Field 0765-120x/0100-0000 | | 1.2.7.103 | I/O System Field 0765-150x/0100-0000 | | 1.2.1.102 | I/O System Field 0765-2101/0100-0000 | | 1.2.5.101 | I/O System Field 0765-2102/0100-0000 | | 1.2.1.100 | I/O System Field 0765-410x/0100-0000 | | 1.2.7.100 | I/O System Field 0765-420x/0100-0000 | | 1.2.7.103 | I/O System Field 0765-450x/0100-0000 |

Risk Evaluation

A security vulnerability has been identified in the Web-Based Management (WBM) function when OpenVPN is enabled.

Zusammenfassung der Gegenmaßnahmen

The user is able to drop privileges of OpenVPN. How to do this is described in the manual "WAGO I/O System 750/753" at section 7.1.1.5.1.

Risk Evaluation

Multiple vulnerabilities have been identified in WAGO Solution Builder and WAGO Device Sphere that affect components responsible for authentication and system communication.

Zusammenfassung der Gegenmaßnahmen

Update to WAGO Device Sphere version 1.2.2. and WAGO Solution Builder version 2.4.2

Risk Evaluation

The VC Hub incorporates the Magick.NET‑Q16‑AnyCPU component, derived from ImageMagick, to process user‑uploaded images and generate thumbnails within the projects image library. Only authenticated users with the Design Project Permission can upload images.

Zusammenfassung der Gegenmaßnahmen

Update the WAGO Visualization And Control Hub to version 5.0.1.

Risk Evaluation

A vulnerability has been found affecting the Managed Switches of WAGO. An unauthenticated attacker can fully compromise the device via an undocumented function.

Zusammenfassung der Gegenmaßnahmen

Please update your devices to the specified fixed firmware version. | Product | Fixed Version | |-------------------------------------------|---------------| | Lean Managed Switch 852-1812 | V1.2.1.S1 | | Lean Managed Switch 852-1813 | V1.2.1.S1 | | Lean Managed Switch 852-1813/000-001| V1.2.3.S1 | | Lean Managed Switch 852-1816 | V1.2.1.S1 | | Industrial Managed Switch 852-303 | V1.2.8.S1 | | Industrial Managed Switch 852-1305 | V1.2.0.S1 | | Industrial Managed Switch 852-1305/000-001| V1.2.0.S1 | | Industrial Managed Switch 852-1505/000-001| V1.2.0.S1 | | Industrial Managed Switch 852-1505 | V1.1.9.S1 | | Industrial Managed Switch 852-602 | V1.0.6.S1 | | Industrial Managed Switch 852-603 | V1.0.6.S1 | | Industrial Managed Switch 852-1605 | V1.2.5.S1 | | Lean Managed Switch 852-1812/010-000| V1.2.1.S1 | | Lean Managed Switch 852-1813/010-000| V1.2.1.S1 | | Lean Managed Switch 852-1813/010-001| V1.2.1.S1 | | Lean Managed Switch 852-1816/010-000| V1.2.1.S1 |

Risk Evaluation

Several vulnerabilities have been identified in the WAGO 852‑1328 device's web‑based management interface, which is implemented using a modified lighttpd server and custom CGI binaries. These issues include multiple stack buffer overflows, an authentication bypass, and insecure credential storage.

Zusammenfassung der Gegenmaßnahmen

Please update your devices to the specified fixed firmware version 02.65.

Risk Evaluation

Two remote stack buffer overflow vulnerabilities were discovered in WAGO industrial switches. These issues originate from unsafe input handling in custom HTTP request parsing functions within the lighttpd binary. The affected binary lacks modern security features such as PIE and RELRO, increasing the risk of successful exploitation.

Zusammenfassung der Gegenmaßnahmen

Please update your devices to the specified fixed firmware version.

Risk Evaluation

Vulnerabilities have been discovered in the WAGO Device Manager that allow any origin to access the server and set header values, as well as an endpoint that permits read access to the file system. The WAGO Device Manager is a software for configuring and parameterizing single WAGO products, which is included in the firmware. These vulnerabilities could be exploited by attackers to send requests and read server responses through crafted web applications or to access the file system.

Zusammenfassung der Gegenmaßnahmen

Update to Firmware version 04.07.01 (FW29) or 03.10.11 (FW22 Patch 2). For the latest Custom Firmware please contact the WAGO support.

Risk Evaluation

Several WAGO firmwares installed on different devices are impacted by various CODESYS vulnerabilities. These affect the runtime, visualization, and OPC UA server.

Zusammenfassung der Gegenmaßnahmen

Update to Firmware version 04.08.01 (FW30), 01.05.01 (FW05), 03.10.11 (FW22 Patch 2). For the latest Custom Firmware please contact the WAGO support.

Risk Evaluation

Due to a missing authentication check, the WAGO Solution Builder and the WAGO Device Sphere are vulnerable to a potential information exposure.

Zusammenfassung der Gegenmaßnahmen

Please upgrade to the specified version or a later one of the WAGO Device Sphere or the WAGO Solution Builder.

Risk Evaluation

The 750-8xx controller are susceptible to a Denial-of-Service attack due to a flood of network packets. Please consult the original paper for details (link at the bottom of this advisory).

Zusammenfassung der Gegenmaßnahmen

We recommend to operate the devices in closed networks or protect with a firewall against unauthorized access. Another, recommended mitigation is to limit the network traffic via the switch rate limit feature according to your application needs. The switch rate limit can be configured e.g. via Web based Management to minimize the effect of high network load: 750-8xx: Ethernet > "Misc. Configuration" > "internal Port" > "Output Limit Rate" 750-8xxx: Network > Ethernet > 'Switch Configuration' > 'Rate Limit' Please also consult the product manuals as this is a known problem for some devices: 750-880 Go to https://www.wago.com/de/sps/controller-ethernet/p/750-880 external link Select "Downloads" In section "Dokumentation" choose "ETHERNET Programmierbarer Feldbuscontroller 10 / 100 Mbit/s; digitale und analoge Signale V 2.3.0, 03.08.2016" and select your language for the manual. See section 9.3: Functional Restrictions and Limits 750-889 Go to https://www.wago.com/de/sps/controller-ethernet/p/750-889 external link Select "Downloads" In section "Dokumentation" choose "Controller KNX IP KNX IP Controller V 1.0.2, 04.10.2016" and select your language for the manual. See section 10.4: Functional Restrictions and Limits 750-831 Go to https://www.wago.com/de/sps/controller-ethernet/p/750-831 external link Select "Downloads" In section "Dokumentation" choose "BACnet/IP Programmierbarer Feldbuscontroller 10/100 Mbit/s; digitale und analoge Signale V 1.2.1, 20.02.2017" and select your language for the manual. See section 9.5: Functional Restrictions and Limits

Risk Evaluation

The vulnerability in the Ethernet switch circuit is caused by a PullUp resistor at the reset input, leading to premature activation and undefined operation. Switching to a PullDown resistor keeps the switch in reset. This issue affects the CC100, the Touch Panels 600 and the Edge Controller.

Zusammenfassung der Gegenmaßnahmen

To address this vulnerability, it is recommended to utilize a newer hardware revision equipped with Firmware 04.08.05 (FW30). This firmware version is designed to resolve the issue by properly managing the switch activation and configuration process on the revised hardware. It is important to note that older firmware versions will not resolve the problem on the new hardware revision, and therefore upgrading both the hardware and firmware is necessary for an effective remediation.

Risk Evaluation

A missing authentication vulnerability exists in the iocheckd service "I/O-Check" functionality. A single packet can cause a denial of service and weaken credentials resulting in the default documented credentials being applied to the device. An attacker can send an unauthenticated packet to trigger this vulnerability.

Zusammenfassung der Gegenmaßnahmen

The I/O-Check service protocol is only needed during installation and commissioning, not during normal operations. It is highly recommended to disable the IP-port 6626 after commissioning.

Risk Evaluation

A design flaw in the file system management exposes internal system partitions - intended to be hidden - during brief moments when they are mounted by the firmware. These partitions contain sensitive data such as firmware and certificates. Although access to the file system is mediated by a Nucleus layer that supports permission control, these permissions are currently not enforced. As a result, services like FTP/SFTP may inadvertently gain access to critical internal resources, increasing the risk of unauthorized access or data leakage.

Zusammenfassung der Gegenmaßnahmen

Update to Firmware version 13.

Risk Evaluation

A vulnerability in sudo allows a low privileged attacker to execute commands with root rights.

Zusammenfassung der Gegenmaßnahmen

Update to Firmware version 04.08.01 (FW30) or higher.

Risk Evaluation

During installation, identical certificates are installed across all systems instead of unique ones, which are intended for JWT Token encryption and signing.

Zusammenfassung der Gegenmaßnahmen

Update to WAGO Device Sphere version 1.0.1. WAGO Device Sphere version 1.0 can't be used after the 30.06.2025.

Risk Evaluation

The base ctrlX OS apps Device Admin and Solutions contain multiple vulnerabilities. In a worst case scenario, a remote authenticated (low-privileged) attacker might be able to execute arbitrary OS commands running with higher privileges.

Zusammenfassung der Gegenmaßnahmen

Update to Solutions 2.6.1 which is available in the WAGO Download center.

Risk Evaluation

Several WAGO Firmwares are vulnerable to a to a remote attack which allows to bypass the integrity check through OpenSSH. This called Terrapin attack occurs because of mishandled handshake phase.

Zusammenfassung der Gegenmaßnahmen

A fix for the affected Firmwares will be provided with the following firmware versions: - FW22, Patch 2 installed on 750-810x - FW22, Patch 2 installed on 750-821x - FW22, Patch 2 installed on 762-4x0x - FW22, Patch 2 installed on 762-5x0x - FW22, Patch 2 installed on 762-6x0x - FW22, Patch 2 installed on 752-8303 - FW27 installed on 750-811x - FW27 installed on 750-821x - FW27 installed on 751-9301 - FW27 installed on 751-9401 - FW27 installed on 762-4x0x - FW27 installed on 762-5x0x - FW27 installed on 762-6x0x - FW27 installed on 752-8303 - Custom Firmware 03.03.08 (80) installed on 750-820x - Custom Firmware 04.03.03 (72) installed on 751-9301 - Custom Firmware 04.03.03 (72) installed on 751-9401 - Custom Firmware 04.04.03 (70) installed on 750-821x

Risk Evaluation

The Year 2038 Problem affects systems using a 32-bit integer to represent time as the number of seconds since January 1st, 1970. On January 19, 2038, at 03:14:07 UTC, the time value will exceed the maximum for a 32-bit integer, causing an overflow and resetting it to a negative number.

Zusammenfassung der Gegenmaßnahmen

Due to the low impact of the vulnerability and the fact that only the logging functionality is affected, there is no fix planned.

Risk Evaluation

An unauthenticated user can exploit a vulnerability (CVE-2018-12981) to inject code in the WBM via reflected cross-site scripting (XSS), if he is able trick a user to open a special crafted web site. This could allow an attacker to execute code in the context of the user and execute arbitrary commands with restriction to the permissions of the user. Authenticated users can use a vulnerability to inject code in the WBM via persistent cross-site scripting (XSS) via special crafted requests which will be rendered and/or executed in the browser. Authenticated WBM users can transfer arbitrary files to different file system locations (CVE- 2018-12980) to which the web server has the required permissions and partially allowing replacing existing files due weak file permissions (CVE-2018-12979) which can result in an authentication bypass.

Zusammenfassung der Gegenmaßnahmen

Update your device to the latest firmware (FW 02). In case this is not feasible limit the access to trusted users and devices. For details on how to obtain the new firmware, please send a request by email to support@wago.com.