CVE-2022-45138

WAGO: Missing Authentication for Critical Function

State: Published
Severity: 9.8 Critical
Published: Feb 27, 2023
Updated: Mar 10, 2025
Reserved: Nov 10, 2022

Description

The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API. The vulnerability allows an unauthenticated attacker to read and set several device parameters that can lead to full compromise of the device.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CERTVDE

Weaknesses

CWE-306 Missing Authentication for Critical Function

Affected Products

Product	Versions
Compact Controller CC100 (751-9301)WAGO	FW16 to before FW22Affected FW22 Patch 1Not affected FW23Affected
Edge Controller (752-8303/8000-002)WAGO	FW18 to before FW22Affected FW22 Patch 1Not affected FW23Affected
PFC100 (750-81xx/xxx-xxx)WAGO	FW16 to before FW22Affected FW22 Patch 1Not affected FW23Affected
PFC200 (750-82xx/xxx-xxx)WAGO	FW16 to before FW22Affected FW22 Patch 1Not affected FW23Affected
Touch Panel 600 Advanced Line (762-5xxx)WAGO	FW16 to before FW22Affected FW22 Patch 1Not affected FW23Affected
Touch Panel 600 Marine Line (762-6xxx)WAGO	FW16 to before FW22Affected FW22 Patch 1Not affected FW23Affected
Touch Panel 600 Standard Line (762-4xxx)WAGO	FW16 to before FW22Affected FW22 Patch 1Not affected FW23Affected

References

https://cert.vde.com/en/advisories/VDE-2022-060/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.