title: Command Injection Vulnerability in I/O-Check Service of WAGO PFC100, PFC200 and Touch Panel 600 Series with firmware versions <=FW10
description: The reported vulnerability allows an attacker who has network access to the device to execute code with specially crafted packets in WAGO Series PFC 100 (750-81xx/xxx-xxx), Series PFC 200 (750-82xx/xxx-xxx), Series Wago Touch Panel 600 Standard Line (762-4xxx), Series Wago Touch Panel 600 Advanced Line (762-5xxx), Series Wago Touch Panel 600 Marine Line (762-6xxx) with firmware versions <=FW10.
problem types: CWE-78 OS Command Injection
affected:
{
product: Series PFC 100 (750-81xx/xxx-xxx)
vendor: WAGO
versions:
lessThanOrEqual: FW10, status: affected, version: FW1, versionType: custom
}
{
product: Series PFC 200 (750-82xx/xxx-xxx)
vendor: WAGO
versions:
lessThanOrEqual: FW10, status: affected, version: FW1, versionType: custom
}
{
product: Series Wago Touch Panel 600 Standard Line (762-4xxx)
vendor: WAGO
versions:
lessThanOrEqual: FW10, status: affected, version: FW1, versionType: custom
}
{
product: Series Wago Touch Panel 600 Advanced Line (762-5xxx)
vendor: WAGO
versions:
lessThanOrEqual: FW10, status: affected, version: FW1, versionType: custom
}
{
product: Series Wago Touch Panel 600 Marine Line (762-6xxx)
vendor: WAGO
versions:
lessThanOrEqual: FW10, status: affected, version: FW1, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
]
solutions: The I/O-Check service protocol is only needed during installation and commissioning, not during normal operations. It is highly recommended to disable the I/O-Check service after commissioning. This is the easiest and securest way to protect your device from the listed vulnerabilities.
Regardless to the action described above, the vulnerability has been fixed in FW11, released in December 2017.
workarounds: Disable I/O-Check service
Restrict network access to the device.
Do not directly connect the device to the internet.