Executive Summary

This vulnerability affects the Web-Based Management (WBM) function of WAGO devices when OpenVPN is enabled. An authenticated attacker with high privileges can exploit the OpenVPN configuration via the WBM interface to execute arbitrary shell commands on the device.

The core issue arises because OpenVPN privileges are improperly dropped, allowing privilege escalation and arbitrary command execution. This can lead to full system compromise of the affected WAGO devices.

Affected devices include various WAGO hardware families such as CC100, PFC100 G1 and G2, PFC200 G1 and G2, TP600 series, Edge Controller, and WP400 running vulnerable firmware versions.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability allows an attacker with high privileges to execute arbitrary shell commands on the affected device, potentially leading to full system compromise.

This means the attacker could gain control over the device, manipulate its operations, access sensitive data, disrupt services, or use the device as a foothold for further attacks within the network.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should apply the mitigations described in the WAGO manual "Cyber Security for Controller PFC100 / PFC200," specifically section 7.1.4, and in the product manuals.

These mitigations focus on properly managing OpenVPN privileges to prevent privilege escalation and arbitrary command execution via the web-based management interface.

Applying these mitigations reduces the risk of full system compromise on affected WAGO devices running vulnerable firmware versions.

Useful 0 Not Useful 0

Compliance Impact

The CVE-2024-1490 vulnerability allows an authenticated attacker with high privileges to execute arbitrary shell commands on affected WAGO devices, potentially leading to full system compromise. This can result in unauthorized access to sensitive data, impacting confidentiality, integrity, and availability of the system.

Such a compromise could affect compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive data and system integrity. Unauthorized command execution and potential data breaches may lead to violations of these regulations.

Mitigation steps, including properly dropping OpenVPN privileges as detailed in WAGO's security manuals, are necessary to reduce the risk and help maintain compliance with these standards.

Useful 0 Not Useful 0

Detection Guidance

The CVE-2024-1490 vulnerability affects the Web-Based Management (WBM) function of WAGO devices when OpenVPN is enabled, allowing an authenticated attacker with high privileges to execute arbitrary shell commands.

Detection would involve verifying if the affected WAGO devices are running vulnerable versions of wago_os_linux (up to and including 4.5.10 and 3.10.10) and if the OpenVPN service with web-based management interface is enabled.

Since the vulnerability involves execution of arbitrary shell commands via the OpenVPN management interface, monitoring for unusual OpenVPN management interface activity or unexpected shell command executions on the device could help detect exploitation attempts.

Specific commands to detect this vulnerability are not provided in the available resources.

Useful 0 Not Useful 0