Network Security
Vulnerability Management
Privileged Access Management
Endpoint Security
Threat Hunting
Unified Endpoint Management
Email & Collaboration Security
Contents:
Wago is a German company specializing in electrical connection and automation solutions, and according to an advisory that was recently published by Germany’s CERT@VDE WAGO’s PFC100 and PFC200 PLCs, its Edge Controller product, and Touch Panel 600 HMIs are affected by four memory-related flaws impacting the iocheckd service I/O-Check.
This type of vulnerability can result in corruption of data, a crash, or code execution as the software may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subsequent write operation then produces undefined or unexpected results.
CERT@VDE is the IT platform that coordinates cybersecurity issues related to industrial automation.
The security flaws discovered may allow an attacker to cause a denial of service (DoS) condition, and to even execute arbitrary code, as each vulnerability could be exploited by sending specially crafted packets containing OS commands to the targeted device.
Uri Katz is a protocol researcher at Claroty and has been credited for reporting the flaws to the vendor.
By chaining the shared memory overflow vulnerability (CVE-2021-34566) and the out-of-bound read vulnerability (CVE-2021-34567), we were able to create a full-blown pre-auth remote code execution to take over any WAGO PFC100/200 device remotely.
By exploiting these vulnerabilities, the attacker is potentially able to manipulate or disrupt the device, gain access to the OT network and take over further portions of the network.
The researcher noted that a few hundred WAGO PFC devices are exposed to the internet, meaning that they can be remotely targeted by malicious actors.
WAGO released patches for the vulnerabilities in question in June, and also shared some important mitigation advice.
WAGO noted that the impacted I/O-Check service is needed only during the installation and commissioning of devices, and not during the normal operation, while also advising its customers to disable the service after commissioning.
This is the easiest and securest way to protect your device from the listed vulnerabilities and possible upcoming zero-day exploits.
Dora is a digital marketing specialist within Heimdal™ Security. She is a content creator at heart - always curious about technology and passionate about finding out everything there is to know about cybersecurity.
