CVE-2023-4089

WAGO: Multiple products vulnerable to local file inclusion

State: Published
Severity: 2.7 Low
Published: Oct 17, 2023
Updated: Feb 27, 2025
Reserved: Aug 2, 2023

Description

On affected Wago products an remote attacker with administrative privileges can access files to which he has already access to through an undocumented local file inclusion. This access is logged in a different log file than expected.

Scores

CVSS	Score	Vector	Source
3.1	2.7 Low	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N	CERTVDE

Weaknesses

CWE-610 Externally Controlled Reference to a Resource in Another Sphere

Affected Products

Product	Versions
Compact Controller CC100WAGO	FW19 through FW26Affected
Edge ControllerWAGO	FW18 through FW26Affected
PFC100WAGO	FW16 through FW26Affected
PFC200WAGO	FW16 through FW26Affected
Touch Panel 600 Advanced LineWAGO	FW16 through FW26Affected
Touch Panel 600 Marine LineWAGO	FW16 through FW26Affected
Touch Panel 600 Standard LineWAGO	FW16 through FW26Affected

References

https://cert.vde.com/en/advisories/VDE-2023-046/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.