CVE-2020-12506 WAGO: Authentication Bypass Vulnerability in WAGO 750-36X and WAGO 750-8XX Versions <= FW03
Attackers can modify device settings without authentication on vulnerable WAGO I/O controllers, requiring firmware updates to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-12506?
CVE-2020-12506 is a critical authentication bypass vulnerability in WAGO 750-362, published on 30 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW03 allows an attacker to change the settings of the devices by sending specifically constructed requests without authentication This issue affects: WAGO 750-362, WAGO 750-363, WAGO 750-823, WAGO 750-832/xxx-xxx, WAGO 750-862, WAGO 750-891, WAGO 750-890/xxx-xxx in versions FW03 and prior versions.
Weakness: CWE-306
Which versions are affected by CVE-2020-12506?
It affects 7 products.
Products include Wago 750-362 Firmware, Wago 750-363 Firmware, Wago 750-823 Firmware, Wago 750-832 Firmware, Wago 750-862 Firmware, Wago 750-890 Firmware and 1 more.
How do I fix CVE-2020-12506?
No fix has been published for CVE-2020-12506 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-12506 being exploited?
There is no known exploitation of CVE-2020-12506 in the wild and no public exploit code.
Other vulnerabilities in WAGO 750-362
Sources
Also known as GHSA-8c2w-ph9m-jcmf.