WAGO M&M Software fdtCONTAINER (Update C)

Multiple field device configuration and management software products from WAGO, Emerson, Mitsubishi Electric, Weidmüller, and Pepperl+Fuchs are vulnerable to arbitrary code execution through insecure deserialization of project files (CWE-502). An attacker can craft a malicious project file that, when opened by an authorized user, executes arbitrary code on the workstation with the user's privileges. The affected products include fdtCONTAINER (versions 3.5.x, 4.5.x–4.6.x), dtmINSPECTOR (based on FDT 1.2.x), Weidmüller WI Manager (up to 2.5.1), Mitsubishi Electric MELSOFT FieldDeviceConfigurator (up to 1.05 F), Pepperl+Fuchs PACTware (5.0–5.0.5.31), and Emerson Rosemount RTIS. Most affected versions do not have fixes available.

Update the fdtCONTAINER component/fdtCONTAINER application to a version that provides a more secure deserialization of the project data. This version will still use a deprecated serialization technology but will fix the currently known attack vector and will be compatible with existing, non-manipulated project files. Update the fdtCONTAINER component/fdtCONTAINER application to a version (fdtCONTAINER component: 3.7 or newer, fdtCONTAINER application: 4.7 or newer) that provides a secure deserialization of the project data with an updated serialization technology. This will break the compatibility to existing, non-manipulated project files.