Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2023-1698

WAGO: WBM Command Injection in multiple products

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CERTVDE

Description

In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behaviour, Denial of Service and full system compromise.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WAGO Compact Controller CC100

Default version status: unaffected

  • FW20 to ≤ FW22affected
  • FW23affected

WAGO Edge Controller

Default version status: unaffected

  • FW22affected

WAGO PFC100

Default version status: unaffected

  • FW20 to ≤ FW22affected
  • FW23affected

WAGO PFC200

Default version status: unaffected

  • FW20 to ≤ FW22affected
  • FW23affected

WAGO Touch Panel 600 Advanced Line

Default version status: unaffected

  • FW22affected

WAGO Touch Panel 600 Marine Line

Default version status: unaffected

  • FW22affected

WAGO Touch Panel 600 Standard Line

Default version status: unaffected

  • FW22affected

References