CVE-2019-12549
📋 TL;DR
WAGO industrial controllers contain hardcoded SSH private keys, allowing attackers to impersonate legitimate devices and gain unauthorized access. This affects WAGO 852-303, 852-1305, and 852-1505 devices with outdated firmware. Attackers can potentially compromise industrial control systems.
💻 Affected Systems
- WAGO 852-303
- WAGO 852-1305
- WAGO 852-1505
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of industrial control systems leading to operational disruption, data theft, or physical damage to critical infrastructure.
Likely Case
Unauthorized access to device configuration, potential lateral movement within industrial networks, and data exfiltration.
If Mitigated
Limited impact if devices are isolated in segmented networks with strict access controls and monitoring.
🎯 Exploit Status
Exploitation requires SSH access to the device, but the hardcoded keys make authentication trivial for attackers who obtain the public key fingerprint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 852-303 FW06, 852-1305 FW06, 852-1505 FW03
Vendor Advisory: https://cert.vde.com/en-us/advisories/vde-2019-013
Restart Required: Yes
Instructions:
1. Download updated firmware from WAGO website. 2. Backup device configuration. 3. Apply firmware update via web interface or management tool. 4. Verify SSH host key has changed after update.
🔧 Temporary Workarounds
Disable SSH access
linuxTemporarily disable SSH service if not required for operations.
systemctl stop sshd
systemctl disable sshd
Restrict SSH access
linuxLimit SSH access to specific IP addresses using firewall rules.
iptables -A INPUT -p tcp --dport 22 -s [TRUSTED_IP] -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP
🧯 If You Can't Patch
- Isolate affected devices in segmented network zones with strict firewall rules.
- Implement network monitoring and intrusion detection for SSH connection attempts.
🔍 How to Verify
Check if Vulnerable:
Check SSH host key fingerprint: ssh-keyscan -t rsa [DEVICE_IP] | ssh-keygen -lf -Check Version:
Check firmware version via web interface or SSH command: cat /etc/issueVerify Fix Applied:
Verify SSH host key fingerprint differs from known hardcoded keys after patching.📡 Detection & Monitoring
Log Indicators:
- Failed SSH authentication attempts
- Successful SSH logins from unexpected sources
- SSH host key mismatch warnings
Network Indicators:
- SSH connections to industrial devices from unauthorized IPs
- SSH traffic patterns inconsistent with normal operations
SIEM Query:
source="ssh.log" (event="Accepted publickey" OR event="Failed publickey") dest_ip="[INDUSTRIAL_DEVICE_IP]"