WAGO Industrial-Managed-Switch Stack Buffer Overflow Vulnerability Allowing Remote Code Execution

A stack buffer overflow vulnerability has been identified in the WAGO Industrial-Managed-Switch models 0852-1322 and 0852-1328, both running firmware through 2.64. An unauthenticated remote attacker can exploit this vulnerability by sending an HTTP request with an excessively long SESSIONID cookie. This exploitation can cause the modified lighttpd server to crash and potentially allow remote code execution, as the stack protections are inadequate.

Impact

Exploitation of this vulnerability can lead to a crash of the web service, remote code execution, and unauthorized access to administrative credentials.

Remediation

Users are advised to update their devices to firmware version 02.65.