Vulnerability-Lookup

GHSA-VHFW-J3C3-CMGG

Vulnerability from github – Published: 2023-06-26 09:30 – Updated: 2024-04-04 05:09

Details

Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a specifically crafted packet to the CODESYS V2 runtime.

Severity ?

4.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-1620"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1288",
      "CWE-20"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-06-26T07:15:09Z",
    "severity": "MODERATE"
  },
  "details": "Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a specifically crafted packet to the CODESYS V2 runtime.",
  "id": "GHSA-vhfw-j3c3-cmgg",
  "modified": "2024-04-04T05:09:45Z",
  "published": "2023-06-26T09:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1620"
    },
    {
      "type": "WEB",
      "url": "https://cert.vde.com/en/advisories/VDE-2023-006"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2023-1620 (GCVE-0-2023-1620)

Vulnerability from cvelistv5 – Published: 2023-06-26 06:19 – Updated: 2024-11-12 14:11

Title

WAGO: DoS in multiple products in multiple versions using Codesys

Summary

Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a specifically crafted packet to the CODESYS V2 runtime.

Severity ?

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-1288 - Improper Validation of Consistency within Input

Assigner

CERTVDE

References

URL

Tags

https://cert.vde.com/en/advisories/VDE-2023-006/

vendor-advisory

Impacted products

Vendor

Product

Version

Wago

750-8202/xxx-xxx

Affected: FW1 , ≤ FW22 SP1 (custom)

Wago	750-8203/xxx-xxx	Affected: FW1 , ≤ FW22 SP1 (custom)
Wago	750-8204/xxx-xxx	Affected: FW1 , ≤ FW22 SP1 (custom)
Wago	750-8206/xxx-xxx	Affected: FW1 , ≤ FW22 SP1 (custom)
Wago	750-8207/xxx-xxx	Affected: FW1 , ≤ FW22 SP1 (custom)
Wago	750-8208/xxx-xxx	Affected: FW1 , ≤ FW22 SP1 (custom)
Wago	750-8210/xxx-xxx	Affected: FW1 , ≤ FW22 SP1 (custom)
Wago	750-8211/xxx-xxx	Affected: FW1 , ≤ FW22 SP1 (custom)
Wago	750-8212/xxx-xxx	Affected: FW1 , ≤ FW22 SP1 (custom)
Wago	750-8213/xxx-xxx	Affected: FW1 , ≤ FW22 SP1 (custom)
Wago	750-8214/xxx-xxx	Affected: FW1 , ≤ FW22 SP1 (custom)
Wago	750-8216/xxx-xxx	Affected: FW1 , ≤ FW22 SP1 (custom)
Wago	750-8217/xxx-xxx	Affected: FW1 , ≤ FW22 SP1 (custom)
Wago	750-823	Affected: FW1 , ≤ FW10 (custom)
Wago	750-332	Affected: FW1 , ≤ FW6 (custom)
Wago	750-832/xxx-xxx	Affected: FW1 , ≤ FW6 (custom)
Wago	750-862	Affected: FW1 , ≤ FW10 (custom)
Wago	750-890/xxx-xxx	Affected: FW1 , ≤ FW10 (custom)
Wago	750-891	Affected: FW1 , ≤ FW10 (custom)
Wago	750-893	Affected: FW1 , ≤ FW10 (custom)
Wago	750-331	Affected: FW1 , ≤ FW14 (custom)
Wago	750-829	Affected: FW1 , ≤ FW14 (custom)
Wago	750-831/xxx-xxx	Affected: FW1 , ≤ FW14 (custom)
Wago	750-852	Affected: FW1 , ≤ FW16 (custom)
Wago	750-880/xxx-xxx	Affected: FW1 , ≤ FW16 (custom)
Wago	750-881	Affected: FW1 , ≤ FW16 (custom)
Wago	750-882	Affected: FW1 , ≤ FW16 (custom)
Wago	750-885/xxx-xxx	Affected: FW1 , ≤ FW16 (custom)
Wago	750-889	Affected: FW1 , ≤ FW16 (custom)

Credits

Daniel dos Santos from Forescout Abdelrahman Hassanien from Forescout

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:57:24.833Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://cert.vde.com/en/advisories/VDE-2023-006/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-1620",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-08T20:30:42.286955Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-12T14:11:36.673Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "750-8202/xxx-xxx",
          "vendor": "Wago",
          "versions": [
            {
              "lessThanOrEqual": "FW22 SP1",
              "status": "affected",
              "version": "FW1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "750-8203/xxx-xxx",
          "vendor": "Wago",
          "versions": [
            {
              "lessThanOrEqual": "FW22 SP1",
              "status": "affected",
              "version": "FW1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "750-8204/xxx-xxx",
          "vendor": "Wago",
          "versions": [
            {
              "lessThanOrEqual": "FW22 SP1",
              "status": "affected",
              "version": "FW1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "750-8206/xxx-xxx",
          "vendor": "Wago",
          "versions": [
            {
              "lessThanOrEqual": "FW22 SP1",
              "status": "affected",
              "version": "FW1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "750-8207/xxx-xxx",
          "vendor": "Wago",
          "versions": [
            {
              "lessThanOrEqual": "FW22 SP1",
              "status": "affected",
              "version": "FW1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "750-8208/xxx-xxx",
          "vendor": "Wago",
          "versions": [
            {
              "lessThanOrEqual": "FW22 SP1",
              "status": "affected",
              "version": "FW1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "750-8210/xxx-xxx",
          "vendor": "Wago",
          "versions": [
            {
              "lessThanOrEqual": "FW22 SP1",
              "status": "affected",
              "version": "FW1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "750-8211/xxx-xxx",
          "vendor": "Wago",
          "versions": [
            {
              "lessThanOrEqual": "FW22 SP1",
              "status": "affected",
              "version": "FW1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "750-8212/xxx-xxx",
          "vendor": "Wago",
          "versions": [
            {
              "lessThanOrEqual": "FW22 SP1",
              "status": "affected",
              "version": "FW1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "750-8213/xxx-xxx",
          "vendor": "Wago",
          "versions": [
            {
              "lessThanOrEqual": "FW22 SP1",
              "status": "affected",
              "version": "FW1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "750-8214/xxx-xxx",
          "vendor": "Wago",
          "versions": [
            {
              "lessThanOrEqual": "FW22 SP1",
              "status": "affected",
              "version": "FW1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "750-8216/xxx-xxx",
          "vendor": "Wago",
          "versions": [
            {
              "lessThanOrEqual": "FW22 SP1",
              "status": "affected",
              "version": "FW1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "750-8217/xxx-xxx",
          "vendor": "Wago",
          "versions": [
            {
              "lessThanOrEqual": "FW22 SP1",
              "status": "affected",
              "version": "FW1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "750-823",
          "vendor": "Wago",
          "versions": [
            {
              "lessThanOrEqual": "FW10",
              "status": "affected",
              "version": "FW1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "750-332",
          "vendor": "Wago",
          "versions": [
            {
              "lessThanOrEqual": "FW6",
              "status": "affected",
              "version": "FW1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "750-832/xxx-xxx",
          "vendor": "Wago",
          "versions": [
            {
              "lessThanOrEqual": "FW6",
              "status": "affected",
              "version": "FW1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "750-862",
          "vendor": "Wago",
          "versions": [
            {
              "lessThanOrEqual": "FW10",
              "status": "affected",
              "version": "FW1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "750-890/xxx-xxx",
          "vendor": "Wago",
          "versions": [
            {
              "lessThanOrEqual": "FW10",
              "status": "affected",
              "version": "FW1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "750-891",
          "vendor": "Wago",
          "versions": [
            {
              "lessThanOrEqual": "FW10",
              "status": "affected",
              "version": "FW1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "750-893",
          "vendor": "Wago",
          "versions": [
            {
              "lessThanOrEqual": "FW10",
              "status": "affected",
              "version": "FW1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "750-331",
          "vendor": "Wago",
          "versions": [
            {
              "lessThanOrEqual": "FW14",
              "status": "affected",
              "version": "FW1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "750-829",
          "vendor": "Wago",
          "versions": [
            {
              "lessThanOrEqual": "FW14",
              "status": "affected",
              "version": "FW1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "750-831/xxx-xxx",
          "vendor": "Wago",
          "versions": [
            {
              "lessThanOrEqual": "FW14",
              "status": "affected",
              "version": "FW1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "750-852",
          "vendor": "Wago",
          "versions": [
            {
              "lessThanOrEqual": "FW16",
              "status": "affected",
              "version": "FW1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "750-880/xxx-xxx",
          "vendor": "Wago",
          "versions": [
            {
              "lessThanOrEqual": "FW16",
              "status": "affected",
              "version": "FW1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "750-881",
          "vendor": "Wago",
          "versions": [
            {
              "lessThanOrEqual": "FW16",
              "status": "affected",
              "version": "FW1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "750-882",
          "vendor": "Wago",
          "versions": [
            {
              "lessThanOrEqual": "FW16",
              "status": "affected",
              "version": "FW1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "750-885/xxx-xxx",
          "vendor": "Wago",
          "versions": [
            {
              "lessThanOrEqual": "FW16",
              "status": "affected",
              "version": "FW1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "750-889",
          "vendor": "Wago",
          "versions": [
            {
              "lessThanOrEqual": "FW16",
              "status": "affected",
              "version": "FW1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Daniel dos Santos from Forescout"
        },
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Abdelrahman Hassanien from Forescout"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a specifically crafted packet to the CODESYS V2 runtime."
            }
          ],
          "value": "Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a specifically crafted packet to the CODESYS V2 runtime."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1288",
              "description": "CWE-1288 Improper Validation of Consistency within Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-02T05:28:51.078Z",
        "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
        "shortName": "CERTVDE"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://cert.vde.com/en/advisories/VDE-2023-006/"
        }
      ],
      "source": {
        "advisory": "VDE-2023-006",
        "defect": [
          "CERT@VDE#64417"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "WAGO: DoS in multiple products in multiple versions using Codesys",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
    "assignerShortName": "CERTVDE",
    "cveId": "CVE-2023-1620",
    "datePublished": "2023-06-26T06:19:30.928Z",
    "dateReserved": "2023-03-24T10:12:26.426Z",
    "dateUpdated": "2024-11-12T14:11:36.673Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-VHFW-J3C3-CMGG

CVE-2023-1620 (GCVE-0-2023-1620)

Tags

Sightings

Nomenclature