Path traversal in dynamically created BACnet File Objects
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 4.8.9, 4.8.9 (70)
- Public exploit
- None on Exploit-DB
- Exploitation: none
- Automatable: yes
- Technical impact: total
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary files on the device, which may lead to full system compromise.
Affected versions
- WAGO 0751-9x01
From 1.0.0 · fixed in 4.8.9
- WAGO 0750-811x-xxxx-xxxx
From 1.0.0 · fixed in 4.8.9
- WAGO 0750-821x-xxx-xxx
From 1.0.0 · fixed in 4.8.9
- WAGO 0762-420x-8000-000x
From 1.0.0 · fixed in 4.8.9
- WAGO 0762-430x-8000-000x
From 1.0.0 · fixed in 4.8.9
- WAGO 0762-520x-8000-000x
From 1.0.0 · fixed in 4.8.9
- WAGO 0762-530x-8000-000x
From 1.0.0 · fixed in 4.8.9
- WAGO 0762-620x-8000-000x
From 1.0.0 · fixed in 4.8.9
- WAGO 0762-630x-8000-000x
From 1.0.0 · fixed in 4.8.9
- WAGO 0752-8303-8000-0002
From 1.0.0 · fixed in 4.8.9
- WAGO 0762-340x
From 1.0.0 · fixed in 4.8.9
- WAGO 0751-9x01
From 1.0.0 · fixed in 4.8.9 (70)
- WAGO 0750-811x-xxxx-xxxx
From 1.0.0 · fixed in 4.8.9 (70)
- WAGO 0750-821x-xxx-xxx
From 1.0.0 · fixed in 4.8.9 (70)
- WAGO 0762-420x-8000-000x
From 1.0.0 · fixed in 4.8.9 (70)
- WAGO 0762-430x-8000-000x
From 1.0.0 · fixed in 4.8.9 (70)
- WAGO 0762-520x-8000-000x
From 1.0.0 · fixed in 4.8.9 (70)
- WAGO 0762-530x-8000-000x
From 1.0.0 · fixed in 4.8.9 (70)
- WAGO 0762-620x-8000-000x
From 1.0.0 · fixed in 4.8.9 (70)
- WAGO 0762-630x-8000-000x
From 1.0.0 · fixed in 4.8.9 (70)
- WAGO 0752-8303-8000-0002
From 1.0.0 · fixed in 4.8.9 (70)
- WAGO 0762-340x
From 1.0.0 · fixed in 4.8.9 (70)