Lucene search

[email protected]CVE-2022-45138

HistoryFeb 27, 2023 - 3:15 p.m.

CVE-2022-45138

2023-02-2715:15:11

CWE-306

[email protected]

web.nvd.nist.gov

cve-2022-45138

vulnerability

web-based management

unauthenticated access

device compromise

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

6.3 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.7%

JSON

The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API. The vulnerability allows an unauthenticated attacker to read and set several device parameters that can lead to full compromise of the device.

Affected configurations

NVD

Node

wago751-9301_firmwareRange16–22

wago751-9301_firmwareMatch22-

wago751-9301_firmwareMatch23

AND

wago751-9301Match-

Node

wago752-8303\/8000-002_firmwareRange18–22

wago752-8303\/8000-002_firmwareMatch22-

wago752-8303\/8000-002_firmwareMatch23

AND

wago752-8303\/8000-002Match-

Node

wagopfc100_firmwareRange16–22

wagopfc100_firmwareMatch22-

wagopfc100_firmwareMatch23

AND

wagopfc100Match-

Node

wagopfc200_firmwareRange16–22

wagopfc200_firmwareMatch22-

wagopfc200_firmwareMatch23

AND

wagopfc200Match-

Node

wagotouch_panel_600_advanced_firmwareRange16–22

wagotouch_panel_600_advanced_firmwareMatch22-

wagotouch_panel_600_advanced_firmwareMatch23

AND

wagotouch_panel_600_advancedMatch-

Node

wagotouch_panel_600_marine_firmwareRange16–22

wagotouch_panel_600_marine_firmwareMatch22-

wagotouch_panel_600_marine_firmwareMatch23

AND

wagotouch_panel_600_marineMatch-

Node

wagotouch_panel_600_standard_firmwareRange16–22

wagotouch_panel_600_standard_firmwareMatch22-

wagotouch_panel_600_standard_firmwareMatch23

AND

wagotouch_panel_600_standardMatch-

CPENameOperatorVersion
wago:751-9301_firmwarewago 751-9301 firmwarelt22
wago:751-9301_firmwarewago 751-9301 firmwareeq23

CPE	Name	Operator	Version
wago:751-9301_firmware	wago 751-9301 firmware	lt	22
wago:751-9301_firmware	wago 751-9301 firmware	eq	23

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Compact Controller CC100 (751-9301)",
    "vendor": "WAGO",
    "versions": [
      {
        "lessThan": "FW22",
        "status": "affected",
        "version": "FW16",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "FW22 Patch 1"
      },
      {
        "status": "affected",
        "version": "FW23"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Edge Controller (752-8303/8000-002)",
    "vendor": "WAGO",
    "versions": [
      {
        "lessThan": "FW22",
        "status": "affected",
        "version": "FW18",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "FW22 Patch 1"
      },
      {
        "status": "affected",
        "version": "FW23"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "PFC100 (750-81xx/xxx-xxx)",
    "vendor": "WAGO",
    "versions": [
      {
        "lessThan": "FW22",
        "status": "affected",
        "version": "FW16",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "FW22 Patch 1"
      },
      {
        "status": "affected",
        "version": "FW23"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "PFC200 (750-82xx/xxx-xxx)",
    "vendor": "WAGO",
    "versions": [
      {
        "lessThan": "FW22",
        "status": "affected",
        "version": "FW16",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "FW22 Patch 1"
      },
      {
        "status": "affected",
        "version": "FW23"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Touch Panel 600 Advanced Line (762-5xxx)",
    "vendor": "WAGO",
    "versions": [
      {
        "lessThan": "FW22",
        "status": "affected",
        "version": "FW16",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "FW22 Patch 1"
      },
      {
        "status": "affected",
        "version": "FW23"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Touch Panel 600 Marine Line (762-6xxx)",
    "vendor": "WAGO",
    "versions": [
      {
        "lessThan": "FW22",
        "status": "affected",
        "version": "FW16",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "FW22 Patch 1"
      },
      {
        "status": "affected",
        "version": "FW23"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Touch Panel 600 Standard Line (762-4xxx)",
    "vendor": "WAGO",
    "versions": [
      {
        "lessThan": "FW22",
        "status": "affected",
        "version": "FW16",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "FW22 Patch 1"
      },
      {
        "status": "affected",
        "version": "FW23"
      }
    ]
  }
]