CVE-2016-9362 Auth bypass in WAGO Ethernet cards
Unauthenticated attackers can view and modify device settings by accessing a specific URL on WAGO Ethernet card web servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-9362?
CVE-2016-9362 is a critical authentication bypass vulnerability in WAGO Ethernet cards, published on 13 Feb 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in WAGO 750-8202/PFC200 prior to FW04 (released August 2015), WAGO 750-881 prior to FW09 (released August 2016), and WAGO 0758-0874-0000-0111. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to edit and to view settings without authenticating.
Weakness: CWE-287
Which versions are affected by CVE-2016-9362?
It affects 3 products.
Products include Wago 750-Xxxx Series Firmware, Wago 758-Xxxx Series Firmware, Wago Pfc200 Firmware.
How do I fix CVE-2016-9362?
No fix has been published for CVE-2016-9362 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2016-9362 being exploited?
There is no known exploitation of CVE-2016-9362 in the wild and no public exploit code.
Sources
Also known as GHSA-9grp-vp5p-rx5w.