title: WAGO: Managed Switches: Storage of user credentials in a cookie
description: In multiple managed switches by WAGO in different versions the webserver cookies of the web based UI contain user credentials.
problem types: CWE-312 Cleartext Storage of Sensitive Information
affected:
{
product: 0852-0303
vendor: WAGO
versions:
lessThanOrEqual: V1.2.3.S0, status: affected, version: unspecified, versionType: custom
}
{
product: 0852-1305
vendor: WAGO
versions:
lessThanOrEqual: V1.1.7.S0, status: affected, version: unspecified, versionType: custom
}
{
product: 0852-1505
vendor: WAGO
versions:
lessThanOrEqual: V1.1.6.S0, status: affected, version: unspecified, versionType: custom
}
{
product: 0852-1305/000-001
vendor: WAGO
versions:
lessThanOrEqual: V1.0.4.S0, status: affected, version: unspecified, versionType: custom
}
{
product: 0852-1505/000-001
vendor: WAGO
versions:
lessThanOrEqual: V1.0.4.S0, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
]
solutions: The Web-Based Management is only needed during installation and commissioning, not during normal operations. It is recommended to disable the web server after commissioning. The Command Line Interface (CLI) is an alternative for commissioning the device. This is the easiest and securest way to protect your device from the listed vulnerabilities.
Regardless of the action described above, the vulnerabilities are fixed with following firmware releases:
Item number [FW version]
0852-0303 (HW < 3)* [V1.2.5.S0] Detailed information about the hardware version is described in the installation guide.
0852-0303 (HW >=3)* [V1.2.3.S1] Detailed information about the hardware version is described in the installation guide.
0852-1305 [V1.1.8.S0]
0852-1505 [V1.1.7.S0]
0852-1305/000-001 [V1.1.4.S0]
0852-1505/000-001 [V1.1.4.S0]
workarounds: Disable the web server of the device.
Use the CLI interface of the device.
Update to the latest firmware.
Restrict network access to the device.
Do not directly connect the device to the internet.