WAGO 750-8xxx PLC Denial Of Service / User Enumeration

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Denial of service & User Enumeration product: WAGO 750-8xxx PLC vulnerable version: Firmware 20 Patch 1 v03.08.08 fixed version: Firmware 20 Patch 1 v03.08.08 CVE number:...

CVE-2021-34581

Missing Release of Resource after Effective Lifetime vulnerability in OpenSSL implementation of WAGO 750-831/xxx-xxx, 750-880/xxx-xxx, 750-881, 750-889 in versions FW4 up to FW15 allows an unauthenticated attacker to cause DoS on the device...

CVE-2021-34581

Missing Release of Resource after Effective Lifetime vulnerability in OpenSSL implementation of WAGO 750-831/xxx-xxx, 750-880/xxx-xxx, 750-881, 750-889 in versions FW4 up to FW15 allows an unauthenticated attacker to cause DoS on the device...

CVE-2021-34578

This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically constructed requests without authentication on multiple WAGO PLCs in firmware versions up to FW07...

CVE-2021-34578

This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically constructed requests without authentication on multiple WAGO PLCs in firmware versions up to FW07...

Authentication flaw

This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically constructed requests without authentication on multiple WAGO PLCs in firmware versions up to FW07...

Design/Logic Flaw

Missing Release of Resource after Effective Lifetime vulnerability in OpenSSL implementation of WAGO 750-831/xxx-xxx, 750-880/xxx-xxx, 750-881, 750-889 in versions FW4 up to FW15 allows an unauthenticated attacker to cause DoS on the device...

CVE-2021-34581

CVE-2021-34581 affects WAGO OpenSSL in the PLCs: 750-831/xxx-xxx, 750-880/xxx-xxx, 750-881, 750-889 (FW4–FW15). Root cause is a Missing Release of Resource after Effective Lifetime vulnerability in the OpenSSL implementation, allowing an unauthenticated attacker to cause a Denial of Service on th...

CVE-2021-34581 WAGO: Denial of Service vulnerability inside the OpenSSL implementation

Missing Release of Resource after Effective Lifetime vulnerability in OpenSSL implementation of WAGO 750-831/xxx-xxx, 750-880/xxx-xxx, 750-881, 750-889 in versions FW4 up to FW15 allows an unauthenticated attacker to cause DoS on the device...

CVE-2021-34578 WAGO: Authentication Vulnerability in Web-Based Management

This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically constructed requests without authentication on multiple WAGO PLCs in firmware versions up to FW07...

CVE-2021-34578

CVE-2021-34578 affects WAGO PLCs (e.g., firmware versions up to FW07) where an authentication issue in the WBM allows an attacker with access to read and write device settings by sending specially crafted requests. The vulnerability arises from improper authentication/authorization of settings-pa...

CVE-2021-34581

Missing Release of Resource after Effective Lifetime vulnerability in OpenSSL implementation of WAGO 750-831/xxx-xxx, 750-880/xxx-xxx, 750-881, 750-889 in versions FW4 up to FW15 allows an unauthenticated attacker to cause DoS on the device...

WAGO 安全漏洞

WAGO is a 750-88x series programmable logic controller from WAGO, Germany. This device is designed for applications in industrial environments where digital algorithms operate electronic systems. A security vulnerability in the OpenSSL implementation of the WAGO 750-831/xxx xxx, 750-880/xxx xxx,...

WAGO 授权问题漏洞

WAGO is a 750-88x series programmable logic controller from WAGO, Germany. The device is specifically designed for use in industrial environments as an electronic system for the operation of digital algorithms. An authorization issue exists in WAGO PLC in firmware version FW07, which can be...

Industrial Networks Exposed Through Cloud OT

The benefits of using a cloud-based management platform to monitor and configure industrial control systems ICS devices are obvious — efficiency, cost-savings and better diagnostics just for starters. But new research found critical vulnerabilities in these platforms that could be used to paralyz...

Several New Critical Flaws Affect CODESYS Industrial Automation Software

Cybersecurity researchers on Wednesday disclosed multiple security vulnerabilities impacting CODESYS automation software and the WAGO programmable logic controller PLC platform that could be remotely exploited to take control of a company's cloud operational technology OT infrastructure. The flaw...

The vulnerability of the microprogrammed software of WAGO Series PFC200 programmable logic controllers, related to unlimited resource distribution, allows a intruder to cause malfunctions during maintenance.

The vulnerability of the microprogrammed software in WAGO Series PFC200 programmable logic controllers is related to the unlimited distribution of resources. Exploiting this vulnerability could allow a remote operator to cause a malfunction in the service operation...

The vulnerability of the microprogrammed software for WAGO Series PFC200 programmable logic controllers arises from incorrect restrictions on the path name in the restricted access catalog. This allows an intruder to gain unauthorized access to protected information.

The vulnerability of the microprogrammed software in WAGO Series PFC200 programmable logic controllers is related to incorrect restrictions on the path name in the restricted access catalog. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to...

WAGO Path Traversal Vulnerability

WAGO is a 750-88x series programmable logic controller from WAGO, Germany. The device is designed specifically for applications in industrial environments where digital algorithms operate electronic systems. A security vulnerability exists in the WAGO PFC200 device that can be exploited by an...

CVE-2021-21000

On WAGO PFC200 devices in different firmware versions with special crafted packets an attacker with network access to the device could cause a denial of service for the login service of the runtime...