Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2022-45140

WAGO: Missing Authentication for Critical Function

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CERTVDE

Description

The configuration backend allows an unauthenticated user to write arbitrary data with root privileges to the storage, which could lead to unauthenticated remote code execution and full system compromise.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WAGO Compact Controller CC100 (751-9301)

Default version status: unaffected

  • FW16 to < FW22affected
  • FW22 Patch 1unaffected
  • FW23affected

WAGO Edge Controller (752-8303/8000-002)

Default version status: unaffected

  • FW16 to < FW22affected
  • FW22 Patch 1unaffected
  • FW23affected

WAGO PFC100 (750-81xx/xxx-xxx)

Default version status: unaffected

  • FW16 to < FW22affected
  • FW22 Patch 1unaffected
  • FW23affected

WAGO PFC200 (750-82xx/xxx-xxx)

Default version status: unaffected

  • FW16 to < FW22affected
  • FW22 Patch 1unaffected
  • FW23affected

WAGO Touch Panel 600 Advanced Line (762-5xxx)

Default version status: unaffected

  • FW16 to < FW22affected
  • FW22 Patch 1unaffected
  • FW23affected

WAGO Touch Panel 600 Marine Line (762-6xxx)

Default version status: unaffected

  • FW16 to < FW22affected
  • FW22 Patch 1unaffected
  • FW23affected

WAGO Touch Panel 600 Standard Line (762-4xxx)

Default version status: unaffected

  • FW16 to < FW22affected
  • FW22 Patch 1unaffected
  • FW23affected

References