CVE-2022-3843

In WAGO Unmanaged Switch 852-111/000-001 in firmware version 01 an undocumented configuration interface without authorization allows an remote attacker to read system information and configure a limited set of parameters...

CVE-2022-3843 WAGO: Exposure of configuration interface in unmanaged switches

In WAGO Unmanaged Switch 852-111/000-001 in firmware version 01 an undocumented configuration interface without authorization allows an remote attacker to read system information and configure a limited set of parameters...

CVE-2022-3843 WAGO: Exposure of configuration interface in unmanaged switches

In WAGO Unmanaged Switch 852-111/000-001 in firmware version 01 an undocumented configuration interface without authorization allows an remote attacker to read system information and configure a limited set of parameters...

CVE-2022-3843

Summary: CVE-2022-3843 affects WAGO Unmanaged Switch (852-111/000-001) with firmware version 01, where an undocumented configuration interface allows an unauthenticated remote attacker to read system information and modify a limited set of parameters. What’s affected: Unmanaged switch product fam...

WAGO 安全漏洞

WAGO is a 750-88x series programmable logic controller from WAGO, Germany. The device is an electronic system designed for the operation of digital algorithms for applications in industrial environments. A security vulnerability exists in WAGO Unmanaged Switch 852-111/000-001 firmware version 01,...

Wago PFC100/200 Web-Based Management Authentication Timing Information Disclosure (CVE-2019-5135)

An exploitable timing discrepancy vulnerability exists in the authentication functionality of the Web-Based Management WBM web application on WAGO PFC100/200 controllers. The WBM application makes use of the PHP crypt function which can be exploited to disclose hashed user credentials. This affec...

Wago PFC200 Cloud Connectivity TimeoutPrepared Command Injection (CVE-2019-5156)

An exploitable command injection vulnerability exists in the cloud connectivity functionality of WAGO PFC200 versions 03.02.0214, 03.01.0713, and 03.00.3912. An attacker can inject operating system commands into the TimeoutPrepared parameter value contained in the firmware update command. This...

Wago PFC200 iocheckd service 'I/O-Check' cache Command Injection (CVE-2019-5171)

An exploitable command injection vulnerability exists in the iocheckd service I/O-Check' function of the WAGO PFC 200 Firmware version 03.02.0214. An attacker can send specially crafted packet at 0x1ea48 to the extracted hostname value from the xml file that is used as an argument to...

Wago PFC200 iocheckd service 'I/O-Check' cache Command Injection (CVE-2019-5169)

An exploitable command injection vulnerability exists in the iocheckd service I/O-Check' function of the WAGO PFC 200 Firmware version 03.02.0214. A specially crafted XML cache file written to a specific location on the device can be used to inject OS commands. An attacker can send a specially...

Wago PFC200 iocheckd service 'I/O-Check' cache Code Execution (CVE-2019-5181)

An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service I/O-Check' functionality of WAGO PFC 200 Firmware version 03.02.0214. A specially crafted XML cache file written to a specific location on the device can cause a stack buffer overflow, resulting in cod...

Wago PFC200 iocheckd service 'I/O-Check' cache Command Injection (CVE-2019-5172)

An exploitable command injection vulnerability exists in the iocheckd service I/O-Check' function of the WAGO PFC 200 Firmware version 03.02.0214. An attacker can send a specially crafted packet to trigger the parsing of this cache file. At 0x1e840 the extracted ntp value from the xml file is use...

WAGO I/O-CHECK Missing Authentication For Critical Function (CVE-2019-5078)

An exploitable denial of service vulnerability exists in the iocheckd service I/O-Check functionality of WAGO PFC200 Firmware versions 03.01.0713 and 03.00.3912, and WAGO PFC100 Firmware version 03.00.3912. A specially crafted set of packets can cause a denial of service, resulting in the device...

WAGO I/O-CHECK Buffer Copy Without Checking Size of Input (CVE-2019-5081)

An exploitable heap buffer overflow vulnerability exists in the iocheckd service ''I/O-Chec'' functionality of WAGO PFC 200 Firmware version 03.01.0713 and 03.00.3912, and WAGO PFC100 Firmware version 03.00.3912. A specially crafted set of packets can cause a heap buffer overflow, potentially...

WAGO I/O-CHECK Buffer Access with Incorrect Length Value (CVE-2019-5074)

An exploitable stack buffer overflow vulnerability exists in the iocheckd service ''I/O-Check'' functionality of WAGO PFC200 Firmware version 03.01.0713, WAGO PFC200 Firmware version 03.00.3912 and WAGO PFC100 Firmware version 03.00.3912. A specially crafted set of packets can cause a stack buffe...

WAGO I/O-CHECK Missing Authentication For Critical Function (CVE-2019-5080)

An exploitable denial-of-service vulnerability exists in the iocheckd service I/O-Check functionality of WAGO PFC 200 Firmware versions 03.01.0713 and 03.00.3912, and WAGO PFC100 Firmware version 03.00.3912. A single packet can cause a denial of service and weaken credentials resulting in the...

Wago PFC200 iocheckd service 'I/O-Check' cache DNS code execution vulnerability (CVE-2019-5166)

An exploitable stack buffer overflow vulnerability exists in the iocheckd service I/O-Check' functionality of WAGO PFC 200 version 03.02.0214. A specially crafted XML cache file written to a specific location on the device can cause a stack buffer overflow, resulting in code execution. An attacke...

WAGO I/O-CHECK Buffer Access with Incorrect Length Value (CVE-2019-5075)

An exploitable stack buffer overflow vulnerability exists in the command line utility getcouplerdetails of WAGO PFC200 Firmware versions 03.01.0713 and 03.00.3912, and WAGO PFC100 Firmware version 03.00.3912. A specially crafted set of packets sent to the iocheckd service I/O-Check can cause a...

Wago PFC200 iocheckd service 'I/O-Check' cache Command Injection (CVE-2019-5168)

An exploitable command injection vulnerability exists in the iocheckd service I/O-Check' function of the WAGO PFC 200 version 03.02.0214. An attacker can send a specially crafted XML cache file At 0x1e8a8 the extracted domainname value from the xml file is used as an argument to...

Wago PFC200 iocheckd service 'I/O-Check' cache Command Injection (CVE-2019-5167)

An exploitable command injection vulnerability exists in the iocheckd service I/O-Check' function of the WAGO PFC 200 version 03.02.0214. At 0x1e3f0 the extracted dns value from the xml file is used as an argument to /etc/config-tools/editdnsserver %s dns-server-nr=%d dns- server-name= using...

Wago I/O-Check Service Out-of-bounds Write (CVE-2021-34569)

In WAGO I/O-Check Service in multiple products an attacker can send a specially crafted packet containing OS commands to crash the diagnostic tool and write memory. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL...