Wago Patches Critical Vulnerabilities in PLCs

March 6, 2023

German industrial automation solutions provider Wago has released patches for several of its programmable logic controllers (PLCs) to address four vulnerabilities, including ones that can be exploited to take full control of the targeted device. Two of the flaws have been assigned a critical severity rating based on their CVSS score, including CVE-2022-45138, a missing authentication issue, and CVE-2022-45140, which allows an unauthenticated attacker to write arbitrary data with root privileges. According to Ryan Pickren from the Georgia Institute of Technology’s Cyber-Physical Security Lab, “These bugs can be chained together and weaponized in two different ways: 1) direct network access (I.e. the adversary is within the ICS or is attacking an Internet-facing device) or 2) Via cross-origin web requests (I.e. the adversary lures somebody within the ICS into viewing their malicious website). Neither scenario requires any user-interaction (besides just visiting the site) or permissions. The chain is completely unauthenticated.” In a real-world attack, a threat actor could exploit these vulnerabilities to maliciously control actuators, falsify sensor measurements, and disable all safety controls. Pickren said these vulnerabilities are part of a much larger trend in ICS security that will be described in detail in an upcoming academic paper.

Latest News

• Hatch Bank Reports Data Breach After Hackers Exploit Vulnerability
• Cisco Releases Security Updates to Address Critical Flaw
• Aruba Networks Patches Six Critical Vulnerabilities
• BlackLotus: A Stealthy UEFI Bootkit Bypassing Secure Boot
• Cisco Patches Critical RCE Vulnerability in IP Phones