ICS Advisories

Risk evaluation

The firmware update package (WUP) is not signed entirely. The used password offers no additional security, it is just meant to protect from unintentional modifications of the WUP file. Thus only the integrity of the signed firmware part (rauc file) is protected against intended manipulation. An attacker could manipulate the WUP file in a way that additional files with potentially malicious content are added to the WUP file. In case an authorized user that issues a firmware update could be tricked into installing this manipulated WUP file onto the device, the potentially malicious files would also be copied and installed on to the device and executed with elevated privileges.

Mitigation summary

Execute FW-Update only as user 'admin'.

Risk evaluation

An attacker needs an authorized login on the device in order to exploit the herein mentioned vulnerabilities. The reported vulnerabilities allow a local attacker with valid login credentials who is able to create files on the device to change the devices settings, e.g. default gateway address, time server etc. and potentially execute code.

Mitigation summary

* Disable I/O-Check service. * Restrict network access to the device. * Do not directly connect the device to the internet. * Disable unused TCP/UDP-ports.

Risk evaluation

Multiple vulnerabilities were reported in CODESYS 2.3 Runtime. The CODESYS 2.3 Runtime is an essential component in several WAGO PLC's.

Mitigation summary

If an immediate firmware update is not possible, the WLAN on the unit can also be switched off as a precautionary measure.

Risk evaluation

A Denial-of-Service Vulnerability was reported in CODESYS 2.3 Runtime. The CODESYS 2.3 Runtime is an essential component in several WAGO PLC's. All vulnerable PLCs are listed in chapter 'Affected Products'.

Mitigation summary

1. Use general security best practices to protect systems from local and network attacks. 2. Do not allow direct access to the device from untrusted networks. 3. Update to the latest firmware according to the table in chapter solutions. 4. Disable the CODESYS 2.3 port 2455.

Risk evaluation

Apache Log4j is used for logging events in WAGO Smart Script in Version 4.2 and higher. Events logged by Log4j can contain JNDI references. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. Additionally, Log4j does not protect from self-referential lookups, which can lead to Denial of Service. UPDATE A1/2: Affected versions: CVE-2021-44228 and CVE-2021-45046: WAGO Smart Script >= Version 4.2 and < Version 4.8.1.3 CVE-2021-45105: WAGO Smart Script >= Version 4.2 and < Version 4.8.1.4 CVE-2021-44832 WAGO Smart Script >= Version 4.2 and < Version 4.8.1.5 END UPDATE A1/2

Mitigation summary

Do not use projects from untrusted sources. For further impact information and risk mitigation, see the recommendations of the Apache Foundation https://logging.apache.org/log4j/2.x/security.html Bundesamt für Sicherheit in der Informationstechnik (BSI) https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2021/211211_log4Shell_WarnstufeRot.html

Risk evaluation

A vulnerability is reported in WIBU-SYSTEMS Codemeter. WIBU-SYSTEMS Codemeter is installed by default during e!COCKPIT and WAGO-I/O-Pro (CODESYS 2.3) installations. All currently existing e!COCKPIT installation bundles and WAGO-I/O-Pro (CODESYS 2.3) installation bundles are affected with vulnerable versions of WIBU-SYSTEMS Codemeter.

Mitigation summary

Mitigation Use general security best practices to protect systems from local and network attacks. Disable the container type 'Mass Storage' in CodeMeter via the Windows Registry.

Risk evaluation

The Linux kernel starting from 5.8 has a flaw which can lead to privilege escalation for a local user. The kernel is used in several Versions of the FW of several WAGO products. All vulnerable PLCs are listed in chapter 'Affected Products'.

Mitigation summary

- Restrict network access to the device. - Use strong passwords - Do not directly connect the device to the internet - Disable unused TCP/UDP-ports

Risk evaluation

The 'legal information' plugin of web-based-management contained a vulnerability which allowed execution of arbitrary commands with privileges of www user. UPDATE A 15.06.2023 : Removed PFC100 with FW23 as affected product and from solution PFC200 with FW23 is only affected on 750-821x/xxx-xxx Renamed "FW22 Patch 1" to "FW22 SP1" to match the versions of the download portal

Mitigation summary

As general security measures strongly WAGO recommends: Use general security best practices to protect systems from local and network attacks. Do not allow direct access to the device from untrusted networks. Update to the latest firmware according to the table in chapter solutions. Industrial control systems (ICS) should not be directly accessible from the Internet, but should be protected by consistently applying the defense-in-depth strategy. The BSI provides general information on securing ICS in the ICS Compendium (https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/ICS/ICS-Security_compendium.pdf).

Risk evaluation

Multiple WAGO devices are prone to vulnerabilites in the used CODESYS V3 framework.

Mitigation summary

Vulnerabilities of CODESYS Advisory 2023-02:• Please make sure that the 'port authentication' option in the web-based management is activated. In this way none of the vulnerabilities can be exploited by unauthenticated users.• Please change the default admin password. Vulnerability of CODESYS Advisory 2023-03:• This vulnerability exists in the CODESYS programming service which is needed for commission only. Deactivate the CODESYS programming port in the web-based management if you do not need the service. In addition to the mitigation hints CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits: Use controllers and devices only in a protected environment to minimize network exposure and ensure they are not accessible from outside. Use firewalls to protect and separate the control system network from other networks. Use VPN (Virtual Private Networks) tunnels if remote access is required. Activate and apply user management and password features. Use encrypted communication links. Limit the access to both development and control system by physical means, operating system features, etc. Protect both development and control system by using up to date virus detection solutions. For further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html

Risk evaluation

Nozomi reported eight vulnerabilities to WAGO affecting different firmwares installed on several devices.

Mitigation summary

Update to Firmware 4.6.1 (FW28) or for CC100 devices to 4.6.3 (FW28). For G1 devices update to Firmware 3.10.11 (FW22 Patch 2). For the latest Custom Firmware, please contact the WAGO support.

Risk evaluation

Multiple vulnerabilities in the WAGO I/O-Check Service were reported.

Mitigation summary

- Disable I/O-Check service - Restrict network access to the device. - Do not directly connect the device to the internet.

Risk evaluation

The following firmware versions installed on several devices are are vulnerable due to a vulnerability in CODESYS Control.

Mitigation summary

The vulnerability is only exploitable if the an attacker has successfully logged in with according user rights. To prevent attackers from exploiting the vulnerability it is recommend to change the standard password in the web based management.

Risk evaluation

The communication between e!Cockpit and the programmable logic controller is not encrypted. The broken cryptographic algorithm allows an attacker to decode the password for the e!Cockpit communication and with this to manipulate the application. The password used by e!Cockpit for authentication against the PLC is encrypted with a hard-coded key. An attacker is able to decrypt the password by listening to the network traffic.

Mitigation summary

* Follow the instructions in WAGO's handbook Cyber Security for Controller * Restrict network access to the device. * Do not directly connect the device to the internet * Use an encrypted VPN connection to the device * Disable unused TCP/UDP-ports Typically the e!Cockpit communication is only needed during commissioning of the programmable logic controller and not during normal operations. WAGO highly recommends disabling the TCP Port 11740 and UDP Port 1740 after commissioning or using an encrypted VPN connection to the device.

Risk evaluation

The Web-Based Management (WBM) of WAGOs programmable logic controller (PLC) is typically used for administration, commissioning and updates. With special crafted requests it is possible to change some special parameters without authentication.

Mitigation summary

* Restrict network access to the device. * Do not directly connect the device to the internet. * Disable unused TCP/UDP ports. * Disable web-based management ports 80/443 after the configuration phase

Risk evaluation

The Web-Based Management (WBM) of WAGOs programmable logic controller (PLC) is typically used for administration, commissioning and updates. The SNMP configuration page of the device is vulnerable for a persistent XSS (Cross-Site Scripting) attack.

Mitigation summary

* Restrict network access to the device. * Use strong passwords * Do not directly connect the device to the internet * Disable unused TCP/UDP-ports

Risk evaluation

The Fraunhofer Institute discovered a vulnerability in the Profinet IO Coupler 0750-0375 during fuzzing tests. These tests revealed weaknesses in the validation and processing of incoming data packets across various protocols and services.

Mitigation summary

Update to firmware version 02.10.01 (12).

Risk evaluation

Nozomi Networks reported a vulnerability in the pfc firmware sdk-G2 of libwagosnmp. The WAGO pfc-firmware-sdk-G2 is a software development kit designed for WAGO PFC devices which developers to build and customize the firmware.

Mitigation summary

Update to Firmware 04.07.01 (FW29) or Firmware 03.10.11 (FW22 Patch 2). For the latest Custom Firmware, please contact the WAGO support.

Risk evaluation

Several WAGO Firmwares are vulnerable, due to an incorrect calculation of the buffer size in the CODESYS OPC UA STACK. This can lead to a crash of the runtime of the following firmware versions installed on several devices.

Mitigation summary

The incorrect calculation of the buffer size can be avoided if the maximum supported array length of the OPC UA stack of the CODESYS Control runtime system is limited to a value of 10129639 (Stack.MaxArrayLenth=10129639) or less. This can be achieved by adding the following setting in the runtime configuration under the following path: /etc/codesys3.d/codesyscotrol.cfg