Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2022-45138

WAGO: Missing Authentication for Critical Function

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CERTVDE

Description

The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API. The vulnerability allows an unauthenticated attacker to read and set several device parameters that can lead to full compromise of the device.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WAGO Compact Controller CC100 (751-9301)

Default version status: unaffected

  • FW16 to < FW22affected
  • FW22 Patch 1unaffected
  • FW23affected

WAGO Edge Controller (752-8303/8000-002)

Default version status: unaffected

  • FW18 to < FW22affected
  • FW22 Patch 1unaffected
  • FW23affected

WAGO PFC100 (750-81xx/xxx-xxx)

Default version status: unaffected

  • FW16 to < FW22affected
  • FW22 Patch 1unaffected
  • FW23affected

WAGO PFC200 (750-82xx/xxx-xxx)

Default version status: unaffected

  • FW16 to < FW22affected
  • FW22 Patch 1unaffected
  • FW23affected

WAGO Touch Panel 600 Advanced Line (762-5xxx)

Default version status: unaffected

  • FW16 to < FW22affected
  • FW22 Patch 1unaffected
  • FW23affected

WAGO Touch Panel 600 Marine Line (762-6xxx)

Default version status: unaffected

  • FW16 to < FW22affected
  • FW22 Patch 1unaffected
  • FW23affected

WAGO Touch Panel 600 Standard Line (762-4xxx)

Default version status: unaffected

  • FW16 to < FW22affected
  • FW22 Patch 1unaffected
  • FW23affected

References