High severity · published Dec 5, 2023
CVE-2023-5188
WAGO Improper Input Validation in IEC61850 Server / Telecontrol
7.5
CVSS
1%
EPSS
No
On KEV
Description
The MMS Interpreter of WagoAppRTU in versions below 1.4.6.0 which is used by the WAGO Telecontrol Configurator is vulnerable to malformed packets. An remote unauthenticated attacker could send specifically crafted packets that lead to a denial-of-service condition until restart of the affected device.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TC
Telecontrol Configurator · WAGO
All versions, or not specified · source: vendor, NVD
WA
WagoAppRTU · WAGO
before 1.4.6.0 · source: vendor, NVD