WAGO: WBM Command Injection in multiple products

Vulnerability

The vulnerability resides in the 'legal information' plugin of the web-based management interface on WAGO PFC100 and PFC200 devices. The plugin is vulnerable to command injection. Affected versions include: PFC100/200 with firmware FW22 before SP1, and PFC200 750-821x/xxx-xxx with firmware FW23 (PFC100 with FW23 is not affected). [1]

Exploitation

An unauthenticated attacker can exploit the vulnerability remotely by sending crafted HTTP requests to the affected plugin. No authentication or prior access is required. [1]

Impact

Successful exploitation allows arbitrary command execution with the privileges of the 'www' user, enabling the attacker to modify device configuration, create new users, cause denial of service, or gain full system compromise. [1]

Mitigation

WAGO has released firmware updates: FW22 SP1 and a fixed FW23 version. Users should update affected devices to these patched versions. No workarounds are provided in the advisory. [1]