{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "A vulnerability\u00a0allows\u00a0Bluetooth LE pairing traffic to be sniffed and used to bypass authentication for pairing.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "An unauthenticated attacker can acquire the pairing credentials to authenticate itself to an affected Bluetooth Low Energy device in order to use it. The Attack Complexity is high, the attacker must be adjacent to the network and the attacker must interact with the devices to make use of vulnerability.\n\nAdditional resources:\n\n\u2022 HMS Security Advisory HMSSAR-2023-05-02-001",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "Disable Bluetooth LE if not used.",
        "title": "Mitigation"
      },
      {
        "category": "description",
        "text": "No firmware update will be released to fix this issue.",
        "title": "Remediation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@wago.com",
      "name": "WAGO GmbH \u0026 Co. KG",
      "namespace": "https://www.wago.com/psirt"
    },
    "references": [
      {
        "category": "self",
        "summary": "VDE-2023-014: WAGO: Bluetooth LE vulnerability in WLAN-ETHERNET-Gateway - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2023-014/"
      },
      {
        "category": "self",
        "summary": "VDE-2023-014: WAGO: Bluetooth LE vulnerability in WLAN-ETHERNET-Gateway - CSAF",
        "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2023/vde-2023-014.json"
      },
      {
        "category": "external",
        "summary": "Vendor PSIRT",
        "url": "https://www.wago.com/psirt"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for WAGO GmbH \u0026 Co. KG",
        "url": "https://certvde.com/en/advisories/vendor/wago/"
      }
    ],
    "title": "WAGO: Bluetooth LE vulnerability in WLAN-ETHERNET-Gateway",
    "tracking": {
      "aliases": [
        "VDE-2023-014"
      ],
      "current_release_date": "2023-07-31T07:00:00.000Z",
      "generator": {
        "date": "2025-05-14T13:20:05.072Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.25"
        }
      },
      "id": "VDE-2023-014",
      "initial_release_date": "2023-07-31T07:00:00.000Z",
      "revision_history": [
        {
          "date": "2023-07-31T07:00:00.000Z",
          "number": "1",
          "summary": "Initial revision."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "WAGO WLAN ETHERNET Gateway",
                "product": {
                  "name": "WAGO WLAN ETHERNET Gateway",
                  "product_id": "CSAFPID-11001",
                  "product_identification_helper": {
                    "model_numbers": [
                      "758-918/0000-0001",
                      "758-918"
                    ]
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Hardware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Firmware vers:all/*",
                  "product_id": "CSAFPID-21001"
                }
              }
            ],
            "category": "product_family",
            "name": "Firmware"
          }
        ],
        "category": "vendor",
        "name": "WAGO"
      }
    ],
    "relationships": [
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware vers:all/* installed on WAGO WLAN ETHERNET Gateway",
          "product_id": "CSAFPID-31001"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11001"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-25836",
      "cwe": {
        "id": "CWE-294",
        "name": "Authentication Bypass by Capture-replay"
      },
      "notes": [
        {
          "category": "description",
          "text": "Bluetooth\u00ae Low Energy Pairing in Bluetooth Core Specification v4.0 through v5.3 may permit an unauthenticated MITM to acquire credentials with two pairing devices via adjacent access when the MITM negotiates Legacy Passkey Pairing with the pairing Initiator and Secure Connections Passkey Pairing with the pairing Responder and brute forces the Passkey entered by the user into the Initiator. The MITM attacker can use the identified Passkey value to complete authentication with the Responder via Bluetooth pairing method confusion.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-31001"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Disable Bluetooth LE if not used.",
          "product_ids": [
            "CSAFPID-31001"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "No firmware update will be released to fix this issue.",
          "product_ids": [
            "CSAFPID-31001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001"
          ]
        }
      ],
      "title": "CVE-2022-25836"
    }
  ]
}