by Kastro
Paper/Archive/CVE-2022-50926

CVE-2022-50926

Wago WAGO 750-8212 PFC200 — WAGO 750-8212 PFC200 G2 2ETH RS Privilege Escalation

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 45.7.457 × 209.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

WAGO 750-8212 PFC200 G2 2ETH RS firmware contains a privilege escalation vulnerability that allows attackers to manipulate user session cookies. Attackers can modify the cookie's 'name' and 'roles' parameters to elevate from ordinary user to administrative privileges without authentication.

Affected

ProductAffectedFixed inSource
WAGO 750-8212 PFC200Firmware version 03.05.10(17)–CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

exploitexploit-db.com/exploits/50793refwago.comwriteupvulncheck.com/advisories/wago-pfc-g-eth-rs-privilege-escalation