9.8

CVE-2023-1698

WAGO: WBM Command Injection in multiple products

In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behaviour, Denial of Service and full system compromise.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wago ≫ Compact Controller 100 Firmware Version >= 20 <= 23
   Wago ≫ Compact Controller 100 Version -
Wago ≫ Edge Controller Firmware Version 22
   Wago ≫ Edge Controller Version -
Wago ≫ Pfc100 Firmware Version >= 20 <= 23
   Wago ≫ Pfc100 Version -
Wago ≫ Pfc200 Firmware Version >= 20 <= 23
   Wago ≫ Pfc200 Version -
Wago ≫ Touch Panel 600 Advanced Firmware Version 22 Update -
   Wago ≫ Touch Panel 600 Advanced Version -
Wago ≫ Touch Panel 600 Marine Firmware Version 22 Update -
   Wago ≫ Touch Panel 600 Marine Version -
Wago ≫ Touch Panel 600 Standard Firmware Version 22 Update -
   Wago ≫ Touch Panel 600 Standard Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 82.04% 0.996
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
info@cert.vde.com 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

https://cert.vde.com/en/advisories/VDE-2023-007/
Third Party Advisory