Critical · published August 31, 2021
🚨 An attacker can send sneaky requests and manipulate settings on WAGO PLCs without any authentication. This loophole puts critical systems at risk! 🔥 Think of a vending machine that hands out sodas without checking if you’ve paid. You could just walk up, hit the buttons, and get whatever you want, completely bypassing any security! With this vulnerability, a malicious user can read and write important device settings, like a kid in a candy store. They could tamper with configurations, leading to potentially disastrous outcomes such as system failures or unauthorized control over the PLCs—absolutely devastating!
Think of a vending machine that hands out sodas without checking if you’ve paid. You could just walk up, hit the buttons, and get whatever you want, completely bypassing any security! CVE-2021-34578 exposes WAGO PLCs running firmware versions up to FW07, allowing attackers with access to the Web-Based Management (WBM) interface to send specially crafted requests that bypass authentication checks, granting them control over various settings.
With this vulnerability, a malicious user can read and write important device settings, like a kid in a candy store. They could tamper with configurations, leading to potentially disastrous outcomes such as system failures or unauthorized control over the PLCs—absolutely devastating! To protect your systems, update your firmware immediately to the latest version that addresses this issue. Additionally, if you haven’t already, consider implementing network controls to restrict access to the WBM interface only to trusted users. Take these steps today! You’ve got this! By patching and tightening your security, you can safeguard your systems like a pro! 🛡️