Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2022-45139

WAGO: Origin validation error through CORS misconfiguration

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CERTVDE

Description

A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of information readable the impact only affects a small subset of confidentiality.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WAGO Compact Controller CC100 (751-9301)

Default version status: unaffected

  • FW16 to < FW22affected
  • FW22 Patch 1unaffected
  • FW23affected

WAGO Edge Controller (752-8303/8000-002)

Default version status: unaffected

  • FW18 to < FW22affected
  • FW22 Patch 1unaffected
  • FW23affected

WAGO PFC100 (750-81xx/xxx-xxx)

Default version status: unaffected

  • FW16 to < FW22affected
  • FW22 Patch 1unaffected
  • FW23affected

WAGO PFC200 (750-82xx/xxx-xxx)

Default version status: unaffected

  • FW16 to < FW22affected
  • FW22 Patch 1unaffected
  • FW23affected

WAGO Touch Panel 600 Advanced Line (762-5xxx)

Default version status: unaffected

  • FW16 to < FW22affected
  • FW22 Patch 1unaffected
  • FW23affected

WAGO Touch Panel 600 Marine Line (762-6xxx)

Default version status: unaffected

  • FW16 to < FW22affected
  • FW22 Patch 1unaffected
  • FW23affected

WAGO Touch Panel 600 Standard Line (762-4xxx)

Default version status: unaffected

  • FW16 to < FW22affected
  • FW22 Patch 1unaffected
  • FW23affected

References