CVE-2022-3738

WAGO: Missing authentication for config export functionality in multiple products

State: Published
Severity: 5.9 Medium
Published: Jan 19, 2023
Updated: Apr 2, 2025
Reserved: Oct 28, 2022

Description

The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like credentials and cryptographic material. A valid user has to create a backup after the last reboot for this attack to be successfull.

Scores

CVSS	Score	Vector	Source
3.1	5.9 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N	CERTVDE

Weaknesses

CWE-306 Missing Authentication for Critical Function

Affected Products

Product	Versions
Series WAGO PFC100WAGO	FW16 through FW22Affected
Series WAGO PFC200WAGO	FW16 through FW22Affected
Series WAGO Touch Panel 600 Advanced LineWAGO	FW16 through FW22Affected
Series WAGO Touch Panel 600 Marine LineWAGO	FW16 through FW22Affected
Series WAGO Touch Panel 600 Standard LineWAGO	FW16 through FW22Affected
WAGO Compact Controller CC100WAGO	FW16 through FW22Affected
WAGO Edge ControllerWAGO	FW16 through FW22Affected

References

https://cert.vde.com/en/advisories/VDE-2022-054/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.