by Kastro
Paper/Archive/CVE-2022-45140

CVE-2022-45140

WAGO Compact Controller CC100 (751-9301) — WAGO: Missing Authentication for Critical Function

EPSS 1%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 64.8.648 × 2013.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The configuration backend allows an unauthenticated user to write arbitrary data with root privileges to the storage, which could lead to unauthenticated remote code execution and full system compromise.

Affected

ProductAffectedFixed inSource
Compact Controller CC100 (751-9301)FW16 – < FW22FW22CNA
Compact Controller CC100 (751-9301)FW23–CNA
Edge Controller (752-8303/8000-002)FW16 – < FW22FW22CNA
Edge Controller (752-8303/8000-002)FW23–CNA
PFC100 (750-81xx/xxx-xxx)FW16 – < FW22FW22CNA
PFC100 (750-81xx/xxx-xxx)FW23–CNA
PFC200 (750-82xx/xxx-xxx)FW16 – < FW22FW22CNA
PFC200 (750-82xx/xxx-xxx)FW23–CNA
Touch Panel 600 Advanced Line (762-5xxx)FW16 – < FW22FW22CNA
Touch Panel 600 Advanced Line (762-5xxx)FW23–CNA
Touch Panel 600 Marine Line (762-6xxx)FW16 – < FW22FW22CNA
Touch Panel 600 Marine Line (762-6xxx)FW23–CNA

Scores by source

CERTVDE (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcert.vde.com/en/advisories/VDE-2022-060