title: WAGO Improper Input Validation in IEC61850 Server / Telecontrol
description: The MMS Interpreter of WagoAppRTU in versions below 1.4.6.0 which is used by the WAGO Telecontrol Configurator is vulnerable to malformed packets. An remote unauthenticated attacker could send specifically crafted packets that lead to a denial-of-service condition until restart of the affected device.
problem types: CWE-20 Improper Input Validation
affected:
{
defaultStatus: unaffected
product: Telecontrol Configurator
vendor: WAGO
versions:
status: affected, version: *
}
{
defaultStatus: unaffected
product: WagoAppRTU
vendor: WAGO
versions:
lessThan: 1.4.6.0, status: affected, version: 0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL