Lucene search

CERTVDECVE-2022-45139

HistoryFeb 27, 2023 - 3:15 p.m.

CVE-2022-45139

2023-02-2715:15:11

CWE-346

CERTVDE

web.nvd.nist.gov

cors misconfiguration

cve-2022-45139

nvd

web-based management

disclosure of device information

cpu diagnostics

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

6.6

Confidence

Low

EPSS

0.002

Percentile

58.1%

JSON

A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of information readable the impact only affects a small subset of confidentiality.

Affected configurations

Nvd

Node

wago751-9301_firmwareRange16–22

wago751-9301_firmwareMatch22-

wago751-9301_firmwareMatch23

AND

wago751-9301Match-

Node

wago752-8303\/8000-002_firmwareRange18–22

wago752-8303\/8000-002_firmwareMatch22-

wago752-8303\/8000-002_firmwareMatch23

AND

wago752-8303\/8000-002Match-

Node

wagopfc100_firmwareRange16–22

wagopfc100_firmwareMatch22-

wagopfc100_firmwareMatch23

AND

wagopfc100Match-

Node

wagopfc200_firmwareRange16–22

wagopfc200_firmwareMatch22-

wagopfc200_firmwareMatch23

AND

wagopfc200Match-

Node

wagotouch_panel_600_advanced_firmwareRange16–22

wagotouch_panel_600_advanced_firmwareMatch22-

wagotouch_panel_600_advanced_firmwareMatch23

AND

wagotouch_panel_600_advancedMatch-

Node

wagotouch_panel_600_marine_firmwareRange16–22

wagotouch_panel_600_marine_firmwareMatch22-

wagotouch_panel_600_marine_firmwareMatch23

AND

wagotouch_panel_600_marineMatch-

Node

wagotouch_panel_600_standard_firmwareRange16–22

wagotouch_panel_600_standard_firmwareMatch22-

wagotouch_panel_600_standard_firmwareMatch23

AND

wagotouch_panel_600_standardMatch-

VendorProductVersionCPE
wago751-9301_firmware*cpe:2.3:o:wago:751-9301_firmware:*:*:*:*:*:*:*:*
wago751-9301_firmware22cpe:2.3:o:wago:751-9301_firmware:22:-:*:*:*:*:*:*
wago751-9301_firmware23cpe:2.3:o:wago:751-9301_firmware:23:*:*:*:*:*:*:*
wago751-9301-cpe:2.3:h:wago:751-9301:-:*:*:*:*:*:*:*
wago752-8303\/8000-002_firmware*cpe:2.3:o:wago:752-8303\/8000-002_firmware:*:*:*:*:*:*:*:*
wago752-8303\/8000-002_firmware22cpe:2.3:o:wago:752-8303\/8000-002_firmware:22:-:*:*:*:*:*:*
wago752-8303\/8000-002_firmware23cpe:2.3:o:wago:752-8303\/8000-002_firmware:23:*:*:*:*:*:*:*
wago752-8303\/8000-002-cpe:2.3:h:wago:752-8303\/8000-002:-:*:*:*:*:*:*:*
wagopfc100_firmware*cpe:2.3:o:wago:pfc100_firmware:*:*:*:*:*:*:*:*
wagopfc100_firmware22cpe:2.3:o:wago:pfc100_firmware:22:-:*:*:*:*:*:*

Vendor	Product	Version	CPE
wago	751-9301_firmware	*	cpe:2.3:o:wago:751-9301_firmware::::::::
wago	751-9301_firmware	22	cpe:2.3:o:wago:751-9301_firmware:22:-::::::
wago	751-9301_firmware	23	cpe:2.3:o:wago:751-9301_firmware:23:::::::*
wago	751-9301	-	cpe:2.3:h:wago:751-9301:-:::::::*
wago	752-8303\/8000-002_firmware	*	cpe:2.3:o:wago:752-8303\/8000-002_firmware::::::::
wago	752-8303\/8000-002_firmware	22	cpe:2.3:o:wago:752-8303\/8000-002_firmware:22:-::::::
wago	752-8303\/8000-002_firmware	23	cpe:2.3:o:wago:752-8303\/8000-002_firmware:23:::::::*
wago	752-8303\/8000-002	-	cpe:2.3:h:wago:752-8303\/8000-002:-:::::::*
wago	pfc100_firmware	*	cpe:2.3:o:wago:pfc100_firmware::::::::
wago	pfc100_firmware	22	cpe:2.3:o:wago:pfc100_firmware:22:-::::::

Rows per page:

1-10 of 281

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Compact Controller CC100 (751-9301)",
    "vendor": "WAGO",
    "versions": [
      {
        "lessThan": "FW22",
        "status": "affected",
        "version": "FW16",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "FW22 Patch 1"
      },
      {
        "status": "affected",
        "version": "FW23"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Edge Controller (752-8303/8000-002)",
    "vendor": "WAGO",
    "versions": [
      {
        "lessThan": "FW22",
        "status": "affected",
        "version": "FW18",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "FW22 Patch 1"
      },
      {
        "status": "affected",
        "version": "FW23"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "PFC100 (750-81xx/xxx-xxx)",
    "vendor": "WAGO",
    "versions": [
      {
        "lessThan": "FW22",
        "status": "affected",
        "version": "FW16",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "FW22 Patch 1"
      },
      {
        "status": "affected",
        "version": "FW23"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "PFC200 (750-82xx/xxx-xxx)",
    "vendor": "WAGO",
    "versions": [
      {
        "lessThan": "FW22",
        "status": "affected",
        "version": "FW16",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "FW22 Patch 1"
      },
      {
        "status": "affected",
        "version": "FW23"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Touch Panel 600 Advanced Line (762-5xxx)",
    "vendor": "WAGO",
    "versions": [
      {
        "lessThan": "FW22",
        "status": "affected",
        "version": "FW16",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "FW22 Patch 1"
      },
      {
        "status": "affected",
        "version": "FW23"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Touch Panel 600 Marine Line (762-6xxx)",
    "vendor": "WAGO",
    "versions": [
      {
        "lessThan": "FW22",
        "status": "affected",
        "version": "FW16",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "FW22 Patch 1"
      },
      {
        "status": "affected",
        "version": "FW23"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Touch Panel 600 Standard Line (762-4xxx)",
    "vendor": "WAGO",
    "versions": [
      {
        "lessThan": "FW22",
        "status": "affected",
        "version": "FW16",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "FW22 Patch 1"
      },
      {
        "status": "affected",
        "version": "FW23"
      }
    ]
  }
]

References

cert.vde.com/en/advisories/VDE-2022-060/

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

6.6

Confidence

Low

EPSS

0.002

Percentile

58.1%

JSON

Related for CVE-2022-45139