Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: WAGO Compact Controller CC100 (751-9301), Edge Controller (752-8303/8000-002) and 5 more products FW22 Clear all filters
TI-2022-22215 CVE-2022-45140 · GHSA-4p8v-g44f-p8hp

WAGO: Missing Authentication for Critical Function

Priority MEDIUM 45

The configuration backend allows an unauthenticated user to write arbitrary data with root privileges to the storage, which could lead to unauthenticated remote code execution and full system compromise.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01067 Published 2023-02-27 Fixed in FW22, FW22 Patch 1 CWE-306
TI-2022-22214 CVE-2022-45139 · GHSA-p586-5mqw-6f9x

WAGO: Origin validation error through CORS misconfiguration

Priority LOW 24

A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00254 Published 2023-02-27 Fixed in FW22, FW22 Patch 1 CWE-346
TI-2022-22213 CVE-2022-45138 · GHSA-hq37-597p-8qrg

WAGO: Missing Authentication for Critical Function

Priority MEDIUM 43

The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0074 Published 2023-02-27 Fixed in FW22, FW22 Patch 1 CWE-306
TI-2022-22212 CVE-2022-45137 · GHSA-rqh8-4mfx-r6p6

WAGO: Reflective Cross-Site Scripting

Priority LOW 27

The configuration backend of the web-based management is vulnerable to reflected XSS (Cross-Site Scripting) attacks that targets the users browser.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00375 Published 2023-02-27 Fixed in FW22, FW22 Patch 1 CWE-79