An exploitable timing discrepancy vulnerability exists in the authentication functionality of the Web-Based Management (WBM) web application on WAGO PFC100/200 controllers. The WBM application makes use of the PHP crypt() function which can be exploited to disclose hashed user credentials. This aff...
5.3CVSS
5.9AI Score
0.001EPSS
An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service βI/O-Checkβ functionality of WAGO PFC 200 Firmware version 03.02.02(14). An attacker can send a specially crafted packet to trigger the parsing of this cache file.The destination buffer sp+0x40 is overfl...
5.5CVSS
6.1AI Score
0.0004EPSS
An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service βI/O-Checkβ functionality of WAGO PFC 200 Firmware version 03.02.02(14). The destination buffer sp+0x440 is overflowed with the call to sprintf() for any domainname values that are greater than 1024-len(...
5.5CVSS
6.2AI Score
0.0004EPSS
An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service βI/O-Checkβ functionality of WAGO PFC 200 Firmware version 03.02.02(14). An attacker can send a specially crafted packet to trigger the parsing of this cache file.The destination buffer sp+0x440 is overf...
5.5CVSS
6.1AI Score
0.0004EPSS
The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like credentials and cryptographic material. A valid user has to create a backup after the last reboot for this attack to be successfull.
5.9CVSS
5.6AI Score
0.002EPSS
A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of info...
5.3CVSS
6.6AI Score
0.002EPSS
Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker to change the passwords of other non-admin users and thus to escalate non-root privileges.
5.3CVSS
5.2AI Score
0.0004EPSS