title: WAGO: Authentication Bypass Vulnerability in WAGO 750-36X and WAGO 750-8XX Versions <= FW03
description: Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW03 allows an attacker to change the settings of the devices by sending specifically constructed requests without authentication This issue affects: WAGO 750-362, WAGO 750-363, WAGO 750-823, WAGO 750-832/xxx-xxx, WAGO 750-862, WAGO 750-891, WAGO 750-890/xxx-xxx in versions FW03 and prior versions.
problem types: CWE-306 Missing Authentication for Critical Function
affected:
{
product: 750-362
vendor: WAGO
versions:
lessThanOrEqual: FW03, status: affected, version: unspecified, versionType: custom
}
{
product: 750-363
vendor: WAGO
versions:
lessThanOrEqual: FW03, status: affected, version: unspecified, versionType: custom
}
{
product: 750-823
vendor: WAGO
versions:
lessThanOrEqual: FW03, status: affected, version: unspecified, versionType: custom
}
{
product: 750-832/xxx-xxx
vendor: WAGO
versions:
lessThanOrEqual: FW03, status: affected, version: unspecified, versionType: custom
}
{
product: 750-862
vendor: WAGO
versions:
lessThanOrEqual: FW03, status: affected, version: unspecified, versionType: custom
}
{
product: 750-891
vendor: WAGO
versions:
lessThanOrEqual: FW03, status: affected, version: unspecified, versionType: custom
}
{
product: 750-890/xxx-xxx
vendor: WAGO
versions:
lessThanOrEqual: FW03, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
version: 3.1
]
solutions: Upgrade devices to the latest standard firmware (> FW03).
workarounds: Restrict network access to the device.
Do not directly connect the device to the internet.
Disable unused TCP/UDP ports.
Disable web-based management ports 80/443 after the configuration phase