CRITICAL🇵🇱 Wersja polska

CVE-2022-45138

CVSS 9.8v3.1pub. 2023-02-27upd. 2024-11-21

The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API. The vulnerability allows an unauthenticated attacker to read and set several device parameters that can lead to full compromise of the device.

🇵🇱 Read Polish description →

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Wago 751 9301
HW
Wago
all versions
Wago 751 9301 Firmware
OS
Wago
222316 – 22 (excl.)
Wago 752 8303\/8000 002
HW
Wago
all versions
Wago 752 8303\/8000 002 Firmware
OS
Wago
222318 – 22 (excl.)
Wago Pfc100
HW
Wago
all versions
Wago Pfc100 Firmware
OS
Wago
222316 – 22 (excl.)
Wago Pfc200
HW
Wago
all versions
Wago Pfc200 Firmware
OS
Wago
222316 – 22 (excl.)
Wago Touch Panel 600 Advanced
HW
Wago
all versions
Wago Touch Panel 600 Advanced Firmware
OS
Wago
222316 – 22 (excl.)
Wago Touch Panel 600 Marine
HW
Wago
all versions
Wago Touch Panel 600 Marine Firmware
OS
Wago
222316 – 22 (excl.)
Wago Touch Panel 600 Standard
HW
Wago
all versions
Wago Touch Panel 600 Standard Firmware
OS
Wago
222316 – 22 (excl.)

🔵

CHECK WITH VENDOR

No clear patch data available. Check vendor references.

Tags

Auth Bypass

CWE

References

cert.vde.com/en/advisories/VDE-2022-060/…

cert.vde.com/en/advisories/VDE-2022-060/…

Related vulnerabilities

CVE-2023-1698CRITICAL9.8PL ✓same product

WAGO: Zdalne przejęcie kontroli przez nieuprawnionego atakującego (command injection)

CVE-2022-45140CRITICAL9.8PL ✓same product

WAGO 751/752: Nieuwierzytelniony zapis danych z uprawnieniami root – RCE

CVE-2021-34566CRITICAL9.1PL ✓same product

Buffer overflow w WAGO I/O-Check Service umożliwia DoS i naruszenie integralności

CVE-2021-34569CRITICAL9.8PL ✓same product

WAGO I/O-Check Service — zapis pamięci i wykonanie poleceń OS przez sieć

CVE-2020-12522CRITICAL10.0PL ✓same product

RCE przez command injection w urządzeniach WAGO PFC 100/200 i Touch Panel 600