CVEvulnerability

CVE-2022-45138

9.8 CRITICAL Published 2023-02-27 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-02-27
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-306

Description

The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API. The vulnerability allows an unauthenticated attacker to read and set several device parameters that can lead to full compromise of the device.

Affected configurations

• wago 751-9301 firmware (>= 16 < 22) • wago 751-9301 firmware 22 • wago 751-9301 firmware 23 • wago 752-8303\/8000-002 firmware (>= 18 < 22) • wago 752-8303\/8000-002 firmware 22 • wago 752-8303\/8000-002 firmware 23 • wago pfc100 firmware (>= 16 < 22) • wago pfc100 firmware 22 • wago pfc100 firmware 23 • wago pfc200 firmware (>= 16 < 22) • wago pfc200 firmware 22 • wago pfc200 firmware 23 • wago touch panel 600 advanced firmware (>= 16 < 22) • wago touch panel 600 advanced firmware 22 • wago touch panel 600 advanced firmware 23 • wago touch panel 600 marine firmware (>= 16 < 22) • wago touch panel 600 marine firmware 22 • wago touch panel 600 marine firmware 23 • wago touch panel 600 standard firmware (>= 16 < 22) • wago touch panel 600 standard firmware 22 • wago touch panel 600 standard firmware 23

Related

Weakness · CWE (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

References