Log in Start free

Vulnerability · Published Sep 30, 2020 · Assigned by CERTVDE

CVE-2020-12506WAGO: Authentication Bypass Vulnerability in WAGO 750-36X and WAGO 750-8XX Versions <= FW03

Critical 9.1

In plain English

A critical-severity missing authentication in 750-362 from WAGO. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)1.5%top 26.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW03 allows an attacker to change the settings of the devices by sending specifically constructed requests without authentication This issue affects: WAGO 750-362, WAGO 750-363, WAGO 750-823, WAGO 750-832/xxx-xxx, WAGO 750-862, WAGO 750-891, WAGO 750-890/xxx-xxx in versions FW03 and prior versions.

Affected products (as reported)

VendorProductVersions
WAGO 750-362 unspecified – through FW03
WAGO 750-363 unspecified – through FW03
WAGO 750-823 unspecified – through FW03
WAGO 750-832/xxx-xxx unspecified – through FW03
WAGO 750-862 unspecified – through FW03
WAGO 750-891 unspecified – through FW03
WAGO 750-890/xxx-xxx unspecified – through FW03

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

References