Skip to content
CVE PROGRAM SOURCE RECORD5.9 Medium

CVE-2022-3738

WAGO: Missing authentication for config export functionality in multiple products

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CERTVDE

Description

The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like credentials and cryptographic material. A valid user has to create a backup after the last reboot for this attack to be successfull.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WAGO Series WAGO PFC100

Default version status: unaffected

  • FW16 to ≤ FW22affected

WAGO Series WAGO PFC200

Default version status: unaffected

  • FW16 to ≤ FW22affected

WAGO Series WAGO Touch Panel 600 Advanced Line

Default version status: unaffected

  • FW16 to ≤ FW22affected

WAGO Series WAGO Touch Panel 600 Marine Line

Default version status: unaffected

  • FW16 to ≤ FW22affected

WAGO Series WAGO Touch Panel 600 Standard Line

Default version status: unaffected

  • FW16 to ≤ FW22affected

WAGO WAGO Compact Controller CC100

Default version status: unaffected

  • FW16 to ≤ FW22affected

WAGO WAGO Edge Controller

Default version status: unaffected

  • FW16 to ≤ FW22affected

References