WAGO 漏洞列表

In multiple products of WAGO, a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behavior, Denial of Service, and full system compromise.

In multiple products of WAGO, a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behavior, Denial of Service, and full system compromise.

Identified WAGO Web-Based Management interfaces that were accessible using default credentials (admin:wago).These interfaces are used to configure and monitor WAGO programmable logic controllers (PLCs) and automation systems. Use of factory-default credentials exposed critical OT infrastructure to unauthorized access.

WAGO系统是一种先进的工业自动化和监控解决方案，它集成了物联网(IoT)架构和现代Web技术，提供了一个强大、灵活且用户友好的平台。WAGO SCADA系统允许用户从任何地点实时监测和控制整个工业过程，确保生产过程的连续性，并提高生产效率。这个系统收集大量工业现场数据，并通过内置的报表工具提供深入的洞察，有助于优化生产决策 。代码执行漏洞允许攻击者通过注入恶意指令或脚本，从而控制受影响的系统，可能导致数据泄露、系统破坏、服务中断、权限提升、恶意软件传播等严重后果，对企业或个人的数据安全、经济利益和声誉造成重大威胁。

WAGO的多个产品中，存在远程命令执行漏洞，攻击者利用该漏洞可在未授权的情况实现远程命令执行，获取目标服务器权限。