WAGO Industrial Managed Switch Authentication Bypass Vulnerability

An authentication bypass vulnerability has been identified in the WAGO Industrial Managed Switch models 0852-1322 and 0852-1328, both running firmware through 2.64. This vulnerability allows unauthenticated remote attackers to exploit inadequate URI validation and employ path traversal sequences to gain unauthorized access to protected CGI endpoints and configuration downloads. Successful exploitation could also lead to access of plaintext administrative credentials.

Impact

Exploitation of this vulnerability allows for authentication bypass, granting unauthorized access to protected CGI endpoints and configuration downloads. Additionally, it enables access to plaintext administrative credentials.

Remediation

Users are advised to update their devices to firmware version 02.65.