Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2023-3379

WAGO: Improper Privilege Management in web-based management

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CERTVDE

Description

Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker to change the passwords of other non-admin users and thus to escalate non-root privileges.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WAGO Compact Controller 100 (751-9301)

Default version status: unaffected

  • 0 to ≤ FW25affected

WAGO PFC100 (750-810x/xxx-xxx)

Default version status: unaffected

  • 0 to ≤ FW22 Patch 1affected

WAGO PFC200 (750-820x/xxx-xxx)

Default version status: unaffected

  • 0 to ≤ FW25affected

WAGO PFC200 (750-821x/xxx-xxx)

Default version status: unaffected

  • 0 to ≤ FW22 Patch 1affected

WAGO Touch Panel 600 Advanced Line (762-5xxx)

Default version status: unaffected

  • 0 to ≤ FW25affected

WAGO Touch Panel 600 Marine Line (762-6xxx)

Default version status: unaffected

  • 0 to ≤ FW25affected

WAGO Touch Panel 600 Standard Line (762-4xxx)

Default version status: unaffected

  • 0 to ≤ FW25affected

Wago Edge Controller (752-8303/8000-002)

Default version status: unaffected

  • 0 to ≤ FW25affected

References