CVE-2012-4879 in WAGO
Summary
by MITRE
The Linux Console on the WAGO I/O System 758 model 758-870, 758-874, 758-875, and 758-876 Industrial PC (IPC) devices has a default password of wago for the (1) root and (2) admin accounts, (3) a default password of user for the user account, and (4) a default password of guest for the guest account, which makes it easier for remote attackers to obtain login access via a TELNET session, a different vulnerability than CVE-2012-3013.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 01/29/2018
The vulnerability identified as CVE-2012-4879 affects the Linux Console implementation within WAGO I/O System 758 series industrial PCs, specifically models 758-870, 758-874, 758-875, and 758-876. These devices operate in industrial environments where security is paramount for maintaining operational integrity and preventing unauthorized access to critical infrastructure. The flaw resides in the default authentication configuration where multiple system accounts utilize predictable and easily guessable passwords that remain unchanged from factory settings. This vulnerability specifically impacts the TELNET service which provides remote access capabilities to the industrial control systems, creating a significant security risk in environments where physical security may be insufficient.
The technical implementation of this vulnerability stems from poor security practices in embedded system design where default credentials are not properly changed or secured during manufacturing and deployment. The affected system employs a default password of "wago" for both root and admin accounts, while the user account uses "user" and the guest account uses "guest" as default credentials. This configuration violates fundamental security principles and creates an attack surface that aligns with CWE-798, which addresses the use of hard-coded credentials in software systems. The vulnerability is particularly concerning because it allows remote attackers to establish TELNET sessions without requiring additional authentication information, effectively bypassing the primary security controls that should protect industrial control systems.
The operational impact of this vulnerability extends beyond simple unauthorized access, as it enables attackers to gain full administrative privileges on industrial control systems that may be managing critical processes such as manufacturing operations, power distribution, or environmental controls. Attackers can leverage these default credentials to execute arbitrary commands, modify system configurations, access sensitive data, and potentially cause operational disruptions or safety hazards in industrial environments. The vulnerability creates an entry point that aligns with ATT&CK technique T1075 which describes the use of valid accounts for unauthorized access. In industrial settings, this could lead to cascading security failures where a compromised industrial PC could potentially affect entire production lines or operational processes, making this vulnerability particularly dangerous in critical infrastructure environments.
Mitigation strategies for CVE-2012-4879 should prioritize immediate credential changes across all affected accounts, with particular emphasis on ensuring that default passwords are never left in production environments. Organizations should implement mandatory password policies that require strong, unique passwords for all accounts, including administrative and guest accounts. Network segmentation should be employed to isolate industrial control systems from general corporate networks, and TELNET services should be disabled in favor of more secure protocols such as SSH. Regular security audits and vulnerability assessments should be conducted to identify and remediate similar issues in industrial control systems, with particular attention to the principle of least privilege and regular credential rotation. System administrators should also consider implementing intrusion detection systems to monitor for unauthorized access attempts and establish secure remote access procedures that do not rely on default credentials.