✕
Request a Demo
Rewterz
Rewterz Threat Alert – Point-of-Sale Breach – Indicators of Compromise
June 13, 2019
Rewterz
Rewterz Threat Alert – Malspam Campaign Delivering Malicious Files Using Compromised Windstream Email Addresses
June 14, 2019

Rewterz Threat Advisory – ICS: WAGO Industrial Managed Switches Multiple Vulnerabilities

Severity

High

Analysis Summary

CVE-2019-12550

An attacker with access to the hard-coded credentials may gain access to the operating system of the managed switch with root privileges, which may allow manipulation of the operating system of the managed switch.

CVE-2019-12549

An attacker with access to the hard-coded SSH key may disrupt communication or compromise the managed switch. The SSH-keys cannot be regenerated by users and all switches use the same key.

Impact

  • Use of Hard-coded Credentials
  • Use of Hard-coded Cryptographic Key
  • Using Components with Known Vulnerabilities

Affected Vendors

WAGO

Affected Products

  • Industrial Managed Switches 852-303
  • 852-1305
  • and 852-1505

Remediation

Vendor recommends users update their managed switch to the latest firmware.

852-303: v1.2.2.S0 or later
https://www.wago.com/us/switches/industrial-managed-switch/p/852-303

852-1305: v1.1.6.S0 or later
https://www.wago.com/us/switches/industrial-managed-switch/p/852-1305

852-1505: v1.1.5.S0 or later
https://www.wago.com/us/switches/industrial-managed-switch/p/852-1505