CVE-2026-3323

VEGA: Privilege escalation through unsecured configuration interface in VEGAPULS devices

State: Published
Severity: 7.5 High
Published: Apr 28, 2026
Updated: Apr 28, 2026
Reserved: Feb 27, 2026

Description

An unsecured configuration interface on affected devices allows unauthenticated remote attackers to access sensitive information, including hashed credentials and access codes.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	CERTVDE

Weaknesses

CWE-306 Missing Authentication for Critical Function

Affected Products

Product	Versions
VEGAPULS 6X Two-wire PROFINET, Modbus TCP, OPC UA (Ethernet-APL)VEGA Grieshaber	1.0.0Affected
VEGAPULS 6X Two-wire PROFINET, Modbus TCP, OPC UA (Ethernet-APL)VEGA Grieshaber	1.1.0Affected

References

https://certvde.com/en/advisories/VDE-2026-016vendor-advisory
https://vega.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-016.jsonvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.