CVE-2023-5872: Wago Smart Designer Info Disclosure Flaw

CVE-2023-5872 Overview

CVE-2023-5872 is an information disclosure vulnerability in Wago Smart Designer versions up to 2.33.1. The vulnerability allows a low-privileged remote attacker to enumerate projects and usernames through iterative requests to a specific endpoint. This flaw is classified under CWE-203 (Observable Discrepancy), which describes vulnerabilities where the product behaves differently or sends different responses in a way that exposes security-relevant information about the state of the system.

Critical Impact

Attackers with low-level privileges can enumerate valid usernames and project names, facilitating reconnaissance for further targeted attacks against the Wago Smart Designer environment.

Affected Products

• Wago Smart Designer versions up to 2.33.1

Discovery Timeline

• 2026-04-16 - CVE-2023-5872 published to NVD
• 2026-04-16 - Last updated in NVD database

Technical Details for CVE-2023-5872

Vulnerability Analysis

This information disclosure vulnerability stems from observable discrepancies in the application's responses when querying a specific endpoint. When an authenticated attacker with low privileges sends requests to this endpoint, the application returns different responses depending on whether a queried username or project exists in the system. This differential behavior enables enumeration attacks where attackers can systematically probe the system to discover valid usernames and project names.

The vulnerability requires network access and low-level authentication, meaning an attacker must first obtain some level of access to the Wago Smart Designer system before exploiting this flaw. While the direct impact is limited to information disclosure without affecting integrity or availability, the exposed information can be leveraged for subsequent attacks such as credential stuffing, targeted phishing, or privilege escalation attempts.

Root Cause

The root cause is an implementation of CWE-203 (Observable Discrepancy) where the application provides different response patterns for valid versus invalid usernames and project names. Instead of returning uniform responses regardless of whether a resource exists, the endpoint leaks information about the existence of users and projects through variations in response content, timing, or status codes.

Attack Vector

The attack is conducted remotely over the network by an authenticated user with minimal privileges. The attacker sends iterative HTTP requests to the vulnerable endpoint, systematically testing potential usernames and project names. By analyzing the differences in the application's responses, the attacker can determine which users and projects exist within the system.

The exploitation process typically involves:

1. The attacker authenticates to Wago Smart Designer with low-privileged credentials
2. The attacker sends requests to the vulnerable endpoint with different username or project name values
3. The application responds differently for valid versus invalid entries
4. The attacker collects valid usernames and project names for use in subsequent attacks

Detection Methods for CVE-2023-5872

Indicators of Compromise

• High volume of requests to specific enumeration-vulnerable endpoints from a single authenticated user
• Sequential or pattern-based queries suggesting automated enumeration attempts
• Unusual access patterns from low-privileged accounts probing user or project resources

Detection Strategies

• Monitor application logs for repeated requests to user or project lookup endpoints
• Implement rate limiting detection to identify rapid sequential queries from the same session
• Analyze authentication logs for low-privileged accounts exhibiting reconnaissance behavior
• Deploy web application firewall (WAF) rules to detect enumeration patterns

Monitoring Recommendations

• Enable detailed logging on endpoints that process user and project queries
• Configure alerts for anomalous request volumes from authenticated sessions
• Implement user behavior analytics to detect enumeration attempts
• Review access logs periodically for signs of iterative probing activity

How to Mitigate CVE-2023-5872

Immediate Actions Required

• Update Wago Smart Designer to a version newer than 2.33.1 when available
• Review and restrict network access to the Wago Smart Designer application
• Audit low-privileged user accounts and revoke unnecessary access
• Implement rate limiting on sensitive endpoints to slow enumeration attempts

Patch Information

Refer to the CERT VDE Advisory VDE-2023-045 for official patch information and update guidance from WAGO. Additional technical details are available in the WAGO CSAF White Paper.

Workarounds

• Implement network segmentation to limit access to Wago Smart Designer from untrusted networks
• Apply strict access controls to minimize the number of users with network access to the application
• Configure firewall rules to restrict access to only authorized IP addresses
• Deploy a web application firewall with rules to detect and block enumeration attempts
• Monitor for and alert on suspicious query patterns until patches can be applied

# Example: Network restriction using iptables
# Restrict access to Wago Smart Designer to trusted networks only
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP