CVE-2023-4089

🗓️ 17 Oct 2023 06:00:28Reported by CERTVDEType

On Wago products, remote attacker can access files through undocumented local file inclusion. File access is logged in different log file

Reporter	Title	Published	Views	Family All 12
BDU FSTEC	The vulnerability of microprogrammed software in WAGO CC100 controllers, Edge Controllers, PFC100, PFC200, Touch Panel 600 Advanced Line, Touch Panel 600 Marine Line, and Touch Panel 600 Standard Line allows a intruder to gain unauthorized access to protected information.	25 Oct 202300:00	–	bdu_fstec
CNNVD	WAGO Security Breach	17 Oct 202300:00	–	cnnvd
Cvelist	CVE-2023-4089 WAGO: Multiple products vulnerable to local file inclusion	17 Oct 202306:00	–	cvelist
EUVD	EUVD-2023-53979	3 Oct 202520:07	–	euvd
ICS	WAGO PFC200 Series	21 Nov 202307:00	–	ics
NVD	CVE-2023-4089	17 Oct 202307:15	–	nvd
OSV	CVE-2023-4089	17 Oct 202307:15	–	osv
Prion	Remote file inclusion	17 Oct 202307:15	–	prion
Positive Technologies	PT-2023-6373 · Wago · Wago	16 Oct 202300:00	–	ptsecurity
RedhatCVE	CVE-2023-4089	9 Jan 202612:31	–	redhatcve

NVD

Vulners

Node

wago compact_controller_100_firmwareRange19–26

AND

wago compact_controller_100Match-

Node

wago edge_controller_firmwareRange18–26

AND

wago edge_controllerMatch-

Node

wago pfc100_firmwareRange16–26

AND

wago pfc100Match-

Node

wago pfc200_firmwareRange16–26

AND

wago pfc200Match-

Node

wago touch_panel_600_advanced_firmwareRange16–26

AND

wago touch_panel_600_advancedMatch-

Node

wago touch_panel_600_marine_firmwareRange16–26

AND

wago touch_panel_600_marineMatch-

Node

wago touch_panel_600_standard_firmwareRange16–26

AND

wago touch_panel_600_standardMatch-

[
  {
    "defaultStatus": "unaffected",
    "product": "Compact Controller CC100",
    "vendor": "WAGO",
    "versions": [
      {
        "lessThanOrEqual": "FW26",
        "status": "affected",
        "version": "FW19",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Edge Controller",
    "vendor": "WAGO",
    "versions": [
      {
        "lessThanOrEqual": "FW26",
        "status": "affected",
        "version": "FW18",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "PFC100",
    "vendor": "WAGO",
    "versions": [
      {
        "lessThanOrEqual": "FW26",
        "status": "affected",
        "version": "FW16",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "PFC200",
    "vendor": "WAGO",
    "versions": [
      {
        "lessThanOrEqual": "FW26",
        "status": "affected",
        "version": "FW16",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Touch Panel 600 Advanced Line",
    "vendor": "WAGO",
    "versions": [
      {
        "lessThanOrEqual": "FW26",
        "status": "affected",
        "version": "FW16",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Touch Panel 600 Marine Line",
    "vendor": "WAGO",
    "versions": [
      {
        "lessThanOrEqual": "FW26",
        "status": "affected",
        "version": "FW16",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Touch Panel 600 Standard Line",
    "vendor": "WAGO",
    "versions": [
      {
        "lessThanOrEqual": "FW26",
        "status": "affected",
        "version": "FW16",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
cert	www.cert.vde.com/en/advisories/VDE-2023-046/

17 Jun 2026 06:37Current

3.6Low risk

Vulners AI Score3.6

CVSS 3.12.7

EPSS0.0047

SSVC

CWE-610