WAGO: Multiple products vulnerable to local file inclusion

Vulnerability

An undocumented local file inclusion vulnerability exists in multiple Wago products. An attacker with administrative privileges can access files they already have access to through an unintended path. The access is logged in a different log file, potentially masking the activity. Affected versions are not explicitly listed but include various Wago controllers and devices. [1]

Exploitation

The attacker must have administrative privileges on the target Wago device. No user interaction is required. The attacker uses an undocumented file inclusion mechanism to access files, resulting in log entries written to a different log file than expected, making detection harder. [1]

Impact

The attacker can read sensitive files they already have access to, but the stealthier logging hides the access. The impact is primarily information disclosure, with reduced auditability. [1]

Mitigation

As of the publication date, no patch is mentioned. Wago may release firmware updates. Mitigation details are not yet disclosed in the available references. [1]