title: WAGO: Vulnerability in web-based authentication in WAGO 750-8XX Version <= FW07
description: Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW07 allows an attacker to change some special parameters without authentication. This issue affects: WAGO 750-852, WAGO 750-880/xxx-xxx, WAGO 750-881, WAGO 750-831/xxx-xxx, WAGO 750-882, WAGO 750-885/xxx-xxx, WAGO 750-889 in versions FW07 and below.
problem types: CWE-306 Missing Authentication for Critical Function
affected:
{
product: 750-852
vendor: WAGO
versions:
lessThanOrEqual: FW07, status: affected, version: unspecified, versionType: custom
}
{
product: 750-880/xxx-xxx
vendor: WAGO
versions:
lessThanOrEqual: FW07, status: affected, version: unspecified, versionType: custom
}
{
product: 750-881
vendor: WAGO
versions:
lessThanOrEqual: FW07, status: affected, version: unspecified, versionType: custom
}
{
product: 750-831/xxx-xxx
vendor: WAGO
versions:
lessThanOrEqual: FW07, status: affected, version: unspecified, versionType: custom
}
{
product: 750-882
vendor: WAGO
versions:
lessThanOrEqual: FW07, status: affected, version: unspecified, versionType: custom
}
{
product: 750-885/xxx-xxx
vendor: WAGO
versions:
lessThanOrEqual: FW07, status: affected, version: unspecified, versionType: custom
}
{
product: 750-889
vendor: WAGO
versions:
lessThanOrEqual: FW07, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
version: 3.1
]
solutions: Upgrade devices to the latest standard firmware (> FW07).
workarounds: Restrict network access to the device.
Do not directly connect the device to the internet.
Disable unused TCP/UDP ports.
Disable web-based management ports 80/443 after the configuration phase