CVE-2023-1698

WAGO: WBM Command Injection in multiple products

State: Published
Severity: 9.8 Critical
Published: May 15, 2023
Updated: Jan 23, 2025
Reserved: Mar 29, 2023

Description

In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behaviour, Denial of Service and full system compromise.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CERTVDE

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
Compact Controller CC100WAGO	FW20 through FW22Affected FW23Affected
Edge ControllerWAGO	FW22Affected
PFC100WAGO	FW20 through FW22Affected FW23Affected
PFC200WAGO	FW20 through FW22Affected FW23Affected
Touch Panel 600 Advanced LineWAGO	FW22Affected
Touch Panel 600 Marine LineWAGO	FW22Affected
Touch Panel 600 Standard LineWAGO	FW22Affected

References

https://cert.vde.com/en/advisories/VDE-2023-007/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.