title: WAGO: PFC200 Access to files outside the home directory
description: On WAGO PFC200 devices in different firmware versions with special crafted packets an authorised attacker with network access to the device can access the file system with higher privileges.
problem types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
affected:
{
product: Series PFC200 Controller
vendor: WAGO
versions:
lessThanOrEqual: FW07, status: affected, version: 750-823, versionType: custom
lessThanOrEqual: FW14, status: affected, version: 750-829, versionType: custom
lessThanOrEqual: FW14, status: affected, version: 750-831/000-00x, versionType: custom
lessThanOrEqual: FW06, status: affected, version: 750-832/000-00x, versionType: custom
lessThanOrEqual: FW14, status: affected, version: 750-852, versionType: custom
lessThanOrEqual: FW07, status: affected, version: 750-862, versionType: custom
lessThanOrEqual: FW15, status: affected, version: 750-880/0xx-xxx, versionType: custom
lessThanOrEqual: FW14, status: affected, version: 750-881, versionType: custom
lessThanOrEqual: FW14, status: affected, version: 750-882, versionType: custom
lessThanOrEqual: FW14, status: affected, version: 750-885/0xx-xxx, versionType: custom
lessThanOrEqual: FW14, status: affected, version: 750-889, versionType: custom
lessThanOrEqual: FW07, status: affected, version: 750-890/0xx-xxx, versionType: custom
lessThanOrEqual: FW07, status: affected, version: 750-891, versionType: custom
lessThanOrEqual: FW07, status: affected, version: 750-893, versionType: custom
}
{
product: Series Ethernet Controller
vendor: WAGO
versions:
lessThan: 03.06.19 (18), status: affected, version: 750-8202/xxx-xxx, versionType: custom
lessThan: 03.06.19 (18), status: affected, version: 750-8203/xxx-xxx, versionType: custom
lessThan: 03.06.19 (18), status: affected, version: 750-8204/xxx-xxx, versionType: custom
lessThan: 03.06.19 (18), status: affected, version: 750-8206/xxx-xxx, versionType: custom
lessThan: 03.06.19 (18), status: affected, version: 750-8207/xxx-xxx, versionType: custom
lessThan: 03.06.19 (18), status: affected, version: 750-8208/xxx-xxx, versionType: custom
lessThan: 03.06.19 (18), status: affected, version: 750-8210/xxx-xxx, versionType: custom
lessThan: 03.06.19 (18), status: affected, version: 750-8211/xxx-xxx, versionType: custom
lessThan: 03.06.19 (18), status: affected, version: 750-8212/xxx-xxx, versionType: custom
lessThan: 03.06.19 (18), status: affected, version: 750-8213/xxx-xxx, versionType: custom
lessThan: 03.06.19 (18), status: affected, version: 750-8214/xxx-xxx, versionType: custom
lessThan: 03.06.19 (18), status: affected, version: 750-8216/xxx-xxx, versionType: custom
lessThan: 03.06.19 (18), status: affected, version: 750-8217/xxx-xxx, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
]
solutions: WAGO recommends all effected users with CODESYS 2.3 Runtime PLCs to update to the firmware versions listed at https://cert.vde.com/en-us/advisories/vde-2021-014 in the solution paragraph.
workarounds: Use general security best practices to protect systems from local and network attacks.
Do not allow direct access to the device from untrusted networks.
Update to the latest firmware according to the table in chapter solutions.