Lucene search

[email protected]CVE-2023-4089

HistoryOct 17, 2023 - 7:15 a.m.

CVE-2023-4089

2023-10-1707:15:10

CWE-610

[email protected]

web.nvd.nist.gov

wago

products

remote attacker

file access

local file inclusion

cve-2023-4089

nvd

2.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

6.8 Medium

AI Score

Confidence

Low

3.3 Low

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:M/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

24.1%

JSON

On affected Wago products an remote attacker with administrative privileges can access files to which he has already access to through an undocumented local file inclusion. This access is logged in a different log file than expected.

CPENameOperatorVersion
wago:compact_controller_100_firmwarewago compact controller 100 firmwarele26
wago:compact_controller_100_firmwarewago compact controller 100 firmwareeq20
wago:compact_controller_100_firmwarewago compact controller 100 firmwareeq25
wago:compact_controller_100_firmwarewago compact controller 100 firmwareeq23
wago:compact_controller_100_firmwarewago compact controller 100 firmwareeq22
wago:compact_controller_100_firmwarewago compact controller 100 firmwareeq19
wago:compact_controller_100_firmwarewago compact controller 100 firmwareeq26

CPE	Name	Operator	Version
wago:compact_controller_100_firmware	wago compact controller 100 firmware	le	26
wago:compact_controller_100_firmware	wago compact controller 100 firmware	eq	20
wago:compact_controller_100_firmware	wago compact controller 100 firmware	eq	25
wago:compact_controller_100_firmware	wago compact controller 100 firmware	eq	23
wago:compact_controller_100_firmware	wago compact controller 100 firmware	eq	22
wago:compact_controller_100_firmware	wago compact controller 100 firmware	eq	19
wago:compact_controller_100_firmware	wago compact controller 100 firmware	eq	26

References

cert.vde.com/en/advisories/VDE-2023-046/

2.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

6.8 Medium

AI Score

Confidence

Low

3.3 Low

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:M/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

24.1%

JSON

Related for CVE-2023-4089

cvelist1 ics1 prion1 nessus1