OTPulse
FeedAboutContact

WAGO: Bluetooth LE vulnerability in WLAN-ETHERNET-Gateway

Monitor7.5VDE-2023-014Jul 31, 2023
Attack VectorAdjacent
Auth RequiredNone
ComplexityHigh
User InteractionRequired
Summary

A Bluetooth LE vulnerability in WAGO WLAN ETHERNET Gateway allows an attacker to sniff pairing traffic and bypass authentication during the Bluetooth pairing process. This affects all versions of the product. No firmware update will be released to fix this issue.

What this means
What could happen
An attacker within Bluetooth range could sniff pairing traffic and bypass authentication to pair with the gateway, potentially gaining unauthorized access to the device and the network it connects to.
Who's at risk
Transportation operators using WAGO WLAN ETHERNET Gateways for remote gateway connectivity or coordination functions should assess whether Bluetooth LE is actively used in their deployments. This is particularly relevant for transit systems, rail operations, and vehicle fleet management systems that rely on wireless gateways for operational technology communications.
How it could be exploited
An attacker with physical proximity (Bluetooth LE range, typically 10-100 meters) passively captures the pairing handshake between a legitimate device and the gateway. The sniffed traffic reveals enough information to forge a valid pairing without knowing the original authentication secret, allowing the attacker to connect to the gateway as if they were authorized.
Prerequisites
  • Physical proximity to the gateway (Bluetooth LE range)
  • Ability to capture and replay Bluetooth LE frames (requires Bluetooth-capable device and tools)
  • Gateway must have Bluetooth LE enabled
  • Active pairing session occurring on the gateway
no patch availablephysically proximate attacker requiredauthentication bypassdefault or weak pairing validation
Affected products (1)
ProductAffected VersionsFix Status
WLAN ETHERNET GatewayAll versionsNo fix (EOL)
Remediation & Mitigation
0/1
Do now
0/1
WORKAROUNDDisable Bluetooth LE functionality on the WLAN ETHERNET Gateway if wireless connectivity is not required for your application
View full CERT@VDE advisory
API: /api/v1/advisories/e945f329-a461-435e-8b68-4afe9b9d001e