Description
User credentials are stored using AES‑ECB encryption with a hardcoded key. An unauthenticated remote attacker obtaining the configuration file can decrypt and recover plaintext usernames and passwords, especially when combined with the authentication bypass.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
WAGO 0852-1322
Default version status: unaffected
0.0.0 to ≤ 2.64affected
WAGO 0852-1328
Default version status: unaffected
0.0.0 to ≤ 2.64affected
WAGO 0852-1322
Default version status: unaffected
2.64affected
WAGO 0852-1328
Default version status: unaffected
2.64affected