File Upload Vulnerability in WAGO e!DISPLAY Devices by WAGO
CVE-2018-12979

6.5MEDIUM

Key Information:

Vendor
Wago
Status
762-3000 Firmware
Vendor
CVE Published:
12 July 2018

Summary

A file upload security flaw in WAGO e!DISPLAY devices (models 762-3000 through 762-3003) allows authenticated users to exploit weak permissions and overwrite critical system files. This vulnerability arises from the unrestricted nature of file uploads in the Web-Based Management (WBM) interface, posing significant risks if not addressed. Users are advised to upgrade to firmware version FW 02 or later to mitigate this issue.

References

https://cert.vde.com/en-us/advisories/vde-2018-010
x_refsource_MISC
https://www.sec-consult.com/en/blog/advisories/remote-cod...
x_refsource_MISC
https://ics-cert.us-cert.gov/advisories/ICSA-18-198-02
x_refsource_MISC

EPSS Score

8% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2018-12979 : File Upload Vulnerability in WAGO e!DISPLAY Devices by WAGO | SecurityVulnerability.io