CVE-2023-4149: WAGO Industrial Managed Switch Vulnerability Exposed to RCE
A severe security vulnerability, identified as CVE-2023-4149, has been discovered in the WAGO Industrial Managed Switch, posing a significant threat to industrial control systems (ICS) and critical infrastructure environments. This vulnerability, characterized by a CVSS score of 9.8, grants unauthenticated remote attackers the ability to inject arbitrary system commands and gain complete control over the affected device, executing commands with root privileges. This means that an attacker could remotely compromise the switch, potentially disrupting operations, stealing sensitive data, or even causing physical damage to connected equipment.
The vulnerability resides in the web-based management interface of the WAGO Industrial Managed Switch. By exploiting this flaw, an attacker can manipulate user requests to execute arbitrary commands on the device, effectively gaining full control over its operations. This vulnerability is particularly concerning due to the device’s role in industrial control systems, where unauthorized access could have devastating consequences.
If exploited, CVE-2023-4149 could allow an attacker to:
-
Gain Full System Control: Execute commands with root privileges, granting complete control over the affected device.
-
Disrupt Operations: Disrupt critical industrial processes by modifying device configurations or manipulating data flows.
-
Steal Sensitive Data: Access sensitive industrial or process control data that could be used for malicious purposes.
-
Cause Physical Damage: In extreme cases, manipulate the device to cause physical damage to connected equipment.
To mitigate the risk associated with CVE-2023-4149, organizations are strongly advised to implement the following measures:
-
Restrict Network Access: Limit network access to the WAGO Industrial Managed Switch, only allowing authorized personnel to connect to the device.
-
Avoid Direct Internet Connection: Do not connect the device directly to the public internet, further reducing the attack surface and potential exposure.
-
Apply Firmware Updates: Promptly apply the latest firmware updates provided by WAGO, specifically firmware version 1.0.6.S0 for products 0852-0602, 0852-0603, and firmware version 1.2.5.S0 for product 852-1605.
