Lucene search

[email protected]CVE-2022-45138

HistoryFeb 27, 2023 - 3:15 p.m.

CVE-2022-45138

2023-02-2715:15:00

CWE-306

[email protected]

web.nvd.nist.gov

cve-2022-45138

vulnerability

web-based management

unauthenticated access

device compromise

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

6.1 Medium

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

54.5%

JSON

The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API. The vulnerability allows an unauthenticated attacker to read and set several device parameters that can lead to full compromise of the device.

CPENameOperatorVersion
wago:751-9301_firmwarewago 751-9301 firmwarelt22
wago:751-9301_firmwarewago 751-9301 firmwareeq23
wago:752-8303\/8000-002_firmwarewago 752-8303\/8000-002 firmwarelt22
wago:752-8303\/8000-002_firmwarewago 752-8303\/8000-002 firmwareeq23
wago:pfc100_firmwarewago pfc100 firmwarelt22
wago:pfc100_firmwarewago pfc100 firmwareeq23
wago:pfc200_firmwarewago pfc200 firmwarelt22
wago:pfc200_firmwarewago pfc200 firmwareeq23
wago:touch_panel_600_advanced_firmwarewago touch panel 600 advanced firmwarelt22
wago:touch_panel_600_advanced_firmwarewago touch panel 600 advanced firmwareeq23

CPE	Name	Operator	Version
wago:751-9301_firmware	wago 751-9301 firmware	lt	22
wago:751-9301_firmware	wago 751-9301 firmware	eq	23
wago:752-8303\/8000-002_firmware	wago 752-8303\/8000-002 firmware	lt	22
wago:752-8303\/8000-002_firmware	wago 752-8303\/8000-002 firmware	eq	23
wago:pfc100_firmware	wago pfc100 firmware	lt	22
wago:pfc100_firmware	wago pfc100 firmware	eq	23
wago:pfc200_firmware	wago pfc200 firmware	lt	22
wago:pfc200_firmware	wago pfc200 firmware	eq	23
wago:touch_panel_600_advanced_firmware	wago touch panel 600 advanced firmware	lt	22
wago:touch_panel_600_advanced_firmware	wago touch panel 600 advanced firmware	eq	23

Rows per page:

1-10 of 141

References

cert.vde.com/en/advisories/VDE-2022-060/

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

6.1 Medium

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

54.5%

JSON

Related for CVE-2022-45138

prion2 nessus2 cvelist2 cve1 thn1