CRITICAL🇵🇱 Wersja polska

CVE-2022-45140

CVSS 9.8v3.1pub. 2023-02-27upd. 2024-11-21

The configuration backend allows an unauthenticated user to write arbitrary data with root privileges to the storage, which could lead to unauthenticated remote code execution and full system compromise.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Wago 751 9301

    HW
    Wago
    all versions

  • Wago 751 9301 Firmware

    OS
    Wago
    222316 – 22 (excl.)

  • Wago 752 8303\/8000 002

    HW
    Wago
    all versions

  • Wago 752 8303\/8000 002 Firmware

    OS
    Wago
    222318 – 22 (excl.)

  • Wago Pfc100

    HW
    Wago
    all versions

  • Wago Pfc100 Firmware

    OS
    Wago
    222316 – 22 (excl.)

  • Wago Pfc200

    HW
    Wago
    all versions

  • Wago Pfc200 Firmware

    OS
    Wago
    222316 – 22 (excl.)

  • Wago Touch Panel 600 Advanced

    HW
    Wago
    all versions

  • Wago Touch Panel 600 Advanced Firmware

    OS
    Wago
    222316 – 22 (excl.)

  • Wago Touch Panel 600 Marine

    HW
    Wago
    all versions

  • Wago Touch Panel 600 Marine Firmware

    OS
    Wago
    222316 – 22 (excl.)

  • Wago Touch Panel 600 Standard

    HW
    Wago
    all versions

  • Wago Touch Panel 600 Standard Firmware

    OS
    Wago
    222316 – 22 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2023-1698CRITICAL9.8PL ✓same product

WAGO: Zdalne przejęcie kontroli przez nieuprawnionego atakującego (command injection)

CVE-2022-45138CRITICAL9.8PL ✓same product

WAGO 751-9301/752-8303: Pominięcie uwierzytelnienia w API zarządzania

CVE-2021-34566CRITICAL9.1PL ✓same product

Buffer overflow w WAGO I/O-Check Service umożliwia DoS i naruszenie integralności

CVE-2021-34569CRITICAL9.8PL ✓same product

WAGO I/O-Check Service — zapis pamięci i wykonanie poleceń OS przez sieć

CVE-2020-12522CRITICAL10.0PL ✓same product

RCE przez command injection w urządzeniach WAGO PFC 100/200 i Touch Panel 600