CRITICAL🇵🇱 Wersja polska

CVE-2023-1698

CVSS 9.8v3.1pub. 2023-05-15upd. 2024-11-21

In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behaviour, Denial of Service and full system compromise.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Wago Compact Controller 100

    HW
    Wago
    all versions

  • Wago Compact Controller 100 Firmware

    OS
    Wago
    20 – 23

  • Wago Edge Controller

    HW
    Wago
    all versions

  • Wago Edge Controller Firmware

    OS
    Wago
    22

  • Wago Pfc100

    HW
    Wago
    all versions

  • Wago Pfc100 Firmware

    OS
    Wago
    20 – 23

  • Wago Pfc200

    HW
    Wago
    all versions

  • Wago Pfc200 Firmware

    OS
    Wago
    20 – 23

  • Wago Touch Panel 600 Advanced

    HW
    Wago
    all versions

  • Wago Touch Panel 600 Advanced Firmware

    OS
    Wago
    22

  • Wago Touch Panel 600 Marine

    HW
    Wago
    all versions

  • Wago Touch Panel 600 Marine Firmware

    OS
    Wago
    22

  • Wago Touch Panel 600 Standard

    HW
    Wago
    all versions

  • Wago Touch Panel 600 Standard Firmware

    OS
    Wago
    22
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
DoSCommand Injection
CWE
References

Related vulnerabilities

CVE-2022-45138CRITICAL9.8PL ✓same product

WAGO 751-9301/752-8303: Pominięcie uwierzytelnienia w API zarządzania

CVE-2022-45140CRITICAL9.8PL ✓same product

WAGO 751/752: Nieuwierzytelniony zapis danych z uprawnieniami root – RCE

CVE-2020-12522CRITICAL10.0PL ✓same product

RCE przez command injection w urządzeniach WAGO PFC 100/200 i Touch Panel 600

CVE-2019-5161CRITICAL9.1PL ✓same product

RCE w WAGO PFC200 — złośliwy plik XML prowadzi do wykonania kodu z uprawnieniami root

CVE-2019-5160CRITICAL9.1PL ✓same product

WAGO PFC200 — nieprawidłowa walidacja hosta w module Cloud Connectivity