9.8

CVE-2022-45140

WAGO: Missing Authentication for Critical Function 

The configuration backend allows an unauthenticated user to write arbitrary data with root privileges to the storage, which could lead to unauthenticated remote code execution and full system compromise.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wago ≫ 751-9301 Firmware Version >= 16 < 22
   Wago ≫ 751-9301 Version -
Wago ≫ 751-9301 Firmware Version 22 Update -
   Wago ≫ 751-9301 Version -
Wago ≫ 751-9301 Firmware Version 23
   Wago ≫ 751-9301 Version -
Wago ≫ 752-8303/8000-002 Firmware Version >= 18 < 22
   Wago ≫ 752-8303/8000-002 Version -
Wago ≫ 752-8303/8000-002 Firmware Version 22 Update -
   Wago ≫ 752-8303/8000-002 Version -
Wago ≫ 752-8303/8000-002 Firmware Version 23
   Wago ≫ 752-8303/8000-002 Version -
Wago ≫ Pfc100 Firmware Version >= 16 < 22
   Wago ≫ Pfc100 Version -
Wago ≫ Pfc100 Firmware Version 22 Update -
   Wago ≫ Pfc100 Version -
Wago ≫ Pfc100 Firmware Version 23
   Wago ≫ Pfc100 Version -
Wago ≫ Pfc200 Firmware Version >= 16 < 22
   Wago ≫ Pfc200 Version -
Wago ≫ Pfc200 Firmware Version 22 Update -
   Wago ≫ Pfc200 Version -
Wago ≫ Pfc200 Firmware Version 23
   Wago ≫ Pfc200 Version -
Wago ≫ Touch Panel 600 Advanced Firmware Version >= 16 < 22
   Wago ≫ Touch Panel 600 Advanced Version -
Wago ≫ Touch Panel 600 Advanced Firmware Version 22 Update -
   Wago ≫ Touch Panel 600 Advanced Version -
Wago ≫ Touch Panel 600 Marine Firmware Version >= 16 < 22
   Wago ≫ Touch Panel 600 Marine Version -
Wago ≫ Touch Panel 600 Marine Firmware Version 22 Update -
   Wago ≫ Touch Panel 600 Marine Version -
Wago ≫ Touch Panel 600 Standard Firmware Version >= 16 < 22
   Wago ≫ Touch Panel 600 Standard Version -
Wago ≫ Touch Panel 600 Standard Firmware Version 22 Update -
   Wago ≫ Touch Panel 600 Standard Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.07% 0.604
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
info@cert.vde.com 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

https://cert.vde.com/en/advisories/VDE-2022-060/
Third Party Advisory