by Kastro
Paper/Archive/CVE-2022-45138

CVE-2022-45138

WAGO Compact Controller CC100 (751-9301) — WAGO: Missing Authentication for Critical Function

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 54.6.546 × 2010.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API. The vulnerability allows an unauthenticated attacker to read and set several device parameters that can lead to full compromise of the device.

Affected

ProductAffectedFixed inSource
Compact Controller CC100 (751-9301)FW16 – < FW22FW22CNA
Compact Controller CC100 (751-9301)FW23–CNA
Edge Controller (752-8303/8000-002)FW18 – < FW22FW22CNA
Edge Controller (752-8303/8000-002)FW23–CNA
PFC100 (750-81xx/xxx-xxx)FW16 – < FW22FW22CNA
PFC100 (750-81xx/xxx-xxx)FW23–CNA
PFC200 (750-82xx/xxx-xxx)FW16 – < FW22FW22CNA
PFC200 (750-82xx/xxx-xxx)FW23–CNA
Touch Panel 600 Advanced Line (762-5xxx)FW16 – < FW22FW22CNA
Touch Panel 600 Advanced Line (762-5xxx)FW23–CNA
Touch Panel 600 Marine Line (762-6xxx)FW16 – < FW22FW22CNA
Touch Panel 600 Marine Line (762-6xxx)FW23–CNA

Scores by source

CERTVDE (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refcert.vde.com/en/advisories/VDE-2022-060