WAGO Solution Builder and WAGO Device Sphere Path Traversal Vulnerability Allowing Sensitive Information Exposure

A path traversal vulnerability has been identified in WAGO Solution Builder versions prior to 2.4.2 and 2.4.1, as well as WAGO Device Sphere version 1.2.1 and versions prior to 1.2.2. This vulnerability allows unauthenticated remote attackers to exploit insufficient input validation, gaining access to backend components beyond their intended scope and resulting in the exposure of sensitive information.

Impact

Exploitation of this vulnerability could lead to unauthorized access to protected system areas, bypassing security controls and exposing sensitive data, thereby reducing overall system trustworthiness.

Remediation

Users are advised to update to WAGO Device Sphere version 1.2.2 and WAGO Solution Builder version 2.4.2.