CVE-2023-4149

The vulnerability is located in the user request handling module in the web management interface. The attacker sends a specially crafted HTTP request to the WWW panel without requiring authentication. Unvalidated input data is passed directly to system calls (CWE-78), allowing injection and execution of arbitrary shell commands with root privileges.

The attacker gains full control over the device's operating system with root privileges — they can read and modify data, install malicious software, disrupt device operation, or use it as an entry point for further compromise of the industrial network.

Patches available from the manufacturer should be applied in accordance with the references (https://cert.vde.com/en/advisories/VDE-2023-037). Until the fix is deployed, it is recommended to isolate the WWW management interface from untrusted networks and restrict access to the administration panel exclusively to trusted IP addresses.

WAGO devices: 0852-0602 (firmware), 0852-0603 (firmware), 0852-1605 (firmware) — specific firmware versions indicated in the manufacturer's references (cert.vde.com VDE-2023-037)