by Kastro
Paper/Archive/CVE-2023-4149

CVE-2023-4149

WAGO Industrial Managed Switch (0852-0602) — WAGO: OS Command Injection Vulnerability in Managed Switch

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 66.1.661 × 2013.2No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A vulnerability in the web-based management allows an unauthenticated remote attacker to inject arbitrary system commands and gain full system control. Those commands are executed with root privileges. The vulnerability is located in the user request handling of the web-based management.

Affected

ProductAffectedFixed inSource
Industrial Managed Switch (0852-0602)< 1.0.6.S01.0.6.S0CNA
Industrial Managed Switch (0852-0603)< 1.0.6.S01.0.6.S0CNA
Industrial Managed Switch (0852-1605)< 1.2.5.S01.2.5.S0CNA

Scores by source

CERTVDE (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refcert.vde.com/en/advisories/VDE-2023-037