CVE-2023-1698

🗓️ 15 May 2023 08:51:27Reported by CERTVDEType

Vulnerability in WAGO products allowing unauthenticated remote attacker to create new users and change device config, leading to Denial of Service and system compromise.

Reporter	Title	Published	Views	Family All 17
GithubExploit	Exploit for OS Command Injection in Wago Compact_Controller_100_Firmware	21 Feb 202515:38	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Wago Compact_Controller_100_Firmware	15 Sep 202320:06	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Wago Compact_Controller_100_Firmware	15 Jun 202517:37	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Wago Compact_Controller_100_Firmware	20 Oct 202312:15	–	githubexploit
Circl	CVE-2023-1698	15 May 202312:29	–	circl
CNNVD	多款WAGO产品操作系统命令注入漏洞	15 May 202300:00	–	cnnvd
Cvelist	CVE-2023-1698 WAGO: WBM Command Injection in multiple products	15 May 202308:51	–	cvelist
Nuclei	WAGO - Remote Command Execution	3 Jun 202606:04	–	nuclei
NVD	CVE-2023-1698	15 May 202309:15	–	nvd
OSV	CVE-2023-1698	15 May 202309:15	–	osv

NVD

Vulners

Node

wago compact_controller_100_firmwareRange20–23

AND

wago compact_controller_100Match-

Node

wago edge_controller_firmwareMatch22

AND

wago edge_controllerMatch-

Node

wago pfc100_firmwareRange20–23

AND

wago pfc100Match-

Node

wago pfc200_firmwareRange20–23

AND

wago pfc200Match-

Node

wago touch_panel_600_advanced_firmwareMatch22-

AND

wago touch_panel_600_advancedMatch-

Node

wago touch_panel_600_marine_firmwareMatch22-

AND

wago touch_panel_600_marineMatch-

Node

wago touch_panel_600_standard_firmwareMatch22-

AND

wago touch_panel_600_standardMatch-

[
  {
    "defaultStatus": "unaffected",
    "product": "Compact Controller CC100",
    "vendor": "WAGO",
    "versions": [
      {
        "lessThanOrEqual": "FW22",
        "status": "affected",
        "version": "FW20",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "FW23"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Edge Controller",
    "vendor": "WAGO",
    "versions": [
      {
        "status": "affected",
        "version": "FW22"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "PFC100",
    "vendor": "WAGO",
    "versions": [
      {
        "lessThanOrEqual": "FW22",
        "status": "affected",
        "version": "FW20",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "FW23"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "PFC200",
    "vendor": "WAGO",
    "versions": [
      {
        "lessThanOrEqual": "FW22",
        "status": "affected",
        "version": "FW20",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "FW23"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Touch Panel 600 Advanced Line",
    "vendor": "WAGO",
    "versions": [
      {
        "status": "affected",
        "version": "FW22"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Touch Panel 600 Marine Line",
    "vendor": "WAGO",
    "versions": [
      {
        "status": "affected",
        "version": "FW22"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Touch Panel 600 Standard Line",
    "vendor": "WAGO",
    "versions": [
      {
        "status": "affected",
        "version": "FW22"
      }
    ]
  }
]

Source	Link
cert	www.cert.vde.com/en/advisories/VDE-2023-007/

21 Nov 2024 07:39Current

9.4High risk

Vulners AI Score9.4

CVSS 3.19.8

EPSS0.94026

SSVC