WAGO: Vulnerabilities in WAGO Industrial-Managed Switches

Two remote stack buffer overflow vulnerabilities were discovered in WAGO industrial switches. These issues originate from unsafe input handling in custom HTTP request parsing functions within the lighttpd binary. The affected binary lacks modern security features such as PIE and RELRO, increasing the risk of successful exploitation.

The vulnerabilities are exploitable without authentication and may allow remote code execution or cause denial of service. Exploitation can disable the web interface until manual intervention, as no automatic recovery mechanisms are in place.

Please update your devices to the specified fixed firmware version 02.64.

WAGO GmbH & Co. KG thanks the following parties for their efforts:

• CERT@VDE for coordination (see https://certvde.com )
• Daniel Hulliger from The Cyber-Defence Campus of armasuisse S+T for reporting