{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An unautheticated remote attacker could send specifically crafted packets to a affected device. If an authenticated user then views that data in a specific page of the web-based management a buffer overflow will be triggered to gain full access of the device."
    },
    {
      "lang": "es",
      "value": "Un atacante remoto no autenticado podr\u00eda enviar paquetes espec\u00edficamente manipulados a un dispositivo afectado. Si un usuario autenticado ve esos datos en una p\u00e1gina espec\u00edfica de la administraci\u00f3n basada en web, se activar\u00e1 un desbordamiento del b\u00fafer para obtener acceso completo al dispositivo."
    }
  ],
  "id": "CVE-2015-10123",
  "lastModified": "2026-04-15T00:35:42.020",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "info@cert.vde.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-03-13T09:15:06.633",
  "references": [
    {
      "source": "info@cert.vde.com",
      "url": "https://cert.vde.com/en/advisories/VDE-2023-039/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://cert.vde.com/en/advisories/VDE-2023-039/"
    }
  ],
  "sourceIdentifier": "info@cert.vde.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-120"
        }
      ],
      "source": "info@cert.vde.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2015-10123"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-120"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-13T09:15:06Z",
    "severity": "HIGH"
  },
  "details": "An unautheticated remote attacker could send specifically crafted packets to a affected device. If an authenticated user then views that data in a specific page of the web-based management a buffer overflow will be triggered to gain full access of the device.\n",
  "id": "GHSA-6qmr-x8pc-q3r8",
  "modified": "2024-03-13T09:31:22Z",
  "published": "2024-03-13T09:31:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-10123"
    },
    {
      "type": "WEB",
      "url": "https://cert.vde.com/en/advisories/VDE-2023-039"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "GSD": {
    "alias": "CVE-2015-10123",
    "id": "GSD-2015-10123"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2015-10123"
      ],
      "details": "An unautheticated remote attacker could send specifically crafted packets to a affected device. If an authenticated user then views that data in a specific page of the web-based management a buffer overflow will be triggered to gain full access of the device.\n",
      "id": "GSD-2015-10123",
      "modified": "2023-12-13T01:20:06.937937Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "info@cert.vde.com",
        "ID": "CVE-2015-10123",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Controller BACnet/IP",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "0",
                          "version_value": "FW13"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Controller BACnet MS/TP",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "0",
                          "version_value": "FW13"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Ethernet Controller 3rd Generation",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "0",
                          "version_value": "FW13"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Fieldbus Coupler Ethernet 3rd Generation",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "0",
                          "version_value": "FW13"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "WAGO"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "An unautheticated remote attacker could send specifically crafted packets to a affected device. If an authenticated user then views that data in a specific page of the web-based management a buffer overflow will be triggered to gain full access of the device.\n"
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.1.0-dev"
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-120",
                "lang": "eng",
                "value": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://cert.vde.com/en/advisories/VDE-2023-039/",
            "refsource": "MISC",
            "url": "https://cert.vde.com/en/advisories/VDE-2023-039/"
          }
        ]
      },
      "source": {
        "advisory": "VDE-2023-039",
        "defect": [
          "CERT@VDE#64546"
        ],
        "discovery": "EXTERNAL"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "descriptions": [
          {
            "lang": "en",
            "value": "An unautheticated remote attacker could send specifically crafted packets to a affected device. If an authenticated user then views that data in a specific page of the web-based management a buffer overflow will be triggered to gain full access of the device.\n"
          },
          {
            "lang": "es",
            "value": "Un atacante remoto no autenticado podr\u00eda enviar paquetes espec\u00edficamente manipulados a un dispositivo afectado. Si un usuario autenticado ve esos datos en una p\u00e1gina espec\u00edfica de la administraci\u00f3n basada en web, se activar\u00e1 un desbordamiento del b\u00fafer para obtener acceso completo al dispositivo."
          }
        ],
        "id": "CVE-2015-10123",
        "lastModified": "2024-03-13T12:33:51.697",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "info@cert.vde.com",
              "type": "Primary"
            }
          ]
        },
        "published": "2024-03-13T09:15:06.633",
        "references": [
          {
            "source": "info@cert.vde.com",
            "url": "https://cert.vde.com/en/advisories/VDE-2023-039/"
          }
        ],
        "sourceIdentifier": "info@cert.vde.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-120"
              }
            ],
            "source": "info@cert.vde.com",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      },
      {
        "names": [
          "Connor Ford"
        ],
        "organization": "Nettitude",
        "summary": "reporting"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "The Web-Based Management (WBM) of WAGOs programmable logic controller (PLC) is typically used for administration, commissioning, and updates.\nThe option to change the configuration data via tools or the web-based-management enabled attackers to prepare cross-site-scripting attacks and under specific circumstances perform remote code execution.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "The web-based management of affected products is vulnerable to Reflective Cross-Site Scripting. This can be used to install malicious code and to gain access to confidential information on a System that connects to the WBM after it has been compromised.\nAdditionally, the affected products contain a buffer overflow vulnerability which enables attackers to remotely execute code, which could lead to compromise of data and execution of malicious code.",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "If not needed, you can deactivate the web-based management to prevent attacks (command line). Disableunused TCP/UDP-ports. Restrict network access to the device. Do not directly connect the device to theinternet.",
        "title": "Mitigation"
      },
      {
        "category": "description",
        "text": "A fix for the affected firmwares will be provided with the following firmware versions:\n\n- FW14 installed on\u00a0750-352/xxx-xxx\n- FW14 installed on 750-88x/xxx-xxx\n- FW14 installed on 750-852\n\nNo fix planned for products:\n\n\u003c= FW13 installed on 750-831/xxx-xxx\n\n\u003c= FW13 installed on 750-829",
        "title": "Remediation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@wago.com",
      "name": "WAGO GmbH \u0026 Co. KG",
      "namespace": "https://www.wago.com/psirt"
    },
    "references": [
      {
        "category": "self",
        "summary": "VDE-2023-039: Wago: Multiple vulnerabilities in web-based management of multiple products - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2023-039/"
      },
      {
        "category": "self",
        "summary": "VDE-2023-039: Wago: Multiple vulnerabilities in web-based management of multiple products - CSAF",
        "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2024/vde-2023-039.json"
      },
      {
        "category": "external",
        "summary": "Vendor PSIRT",
        "url": "https://www.wago.com/psirt"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for WAGO GmbH \u0026 Co. KG",
        "url": "https://certvde.com/en/advisories/vendor/wago/"
      }
    ],
    "title": "Wago: Multiple vulnerabilities in web-based management of multiple products",
    "tracking": {
      "aliases": [
        "VDE-2023-039"
      ],
      "current_release_date": "2024-03-13T08:30:00.000Z",
      "generator": {
        "date": "2025-05-05T09:26:55.122Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.24"
        }
      },
      "id": "VDE-2023-039",
      "initial_release_date": "2024-03-13T08:30:00.000Z",
      "revision_history": [
        {
          "date": "2024-03-13T08:30:00.000Z",
          "number": "1",
          "summary": "Initial revision."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Controller BACnet/IP",
                "product": {
                  "name": "Controller BACnet/IP",
                  "product_id": "CSAFPID-11001",
                  "product_identification_helper": {
                    "model_numbers": [
                      "750-831/xxx-xxx"
                    ]
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Controller BACnet MS/TP",
                "product": {
                  "name": "Controller BACnet MS/TP",
                  "product_id": "CSAFPID-11002",
                  "product_identification_helper": {
                    "model_numbers": [
                      "750-829"
                    ]
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Ethernet Controller 3rd Generation",
                "product": {
                  "name": "Ethernet Controller 3rd Generation",
                  "product_id": "CSAFPID-11003",
                  "product_identification_helper": {
                    "model_numbers": [
                      "750-852",
                      "750-88x/xxx-xxx"
                    ]
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Fieldbus Coupler Ethernet 3rd Generation",
                "product": {
                  "name": "Fieldbus Coupler Ethernet 3rd Generation",
                  "product_id": "CSAFPID-11004",
                  "product_identification_helper": {
                    "model_numbers": [
                      "750-352/xxx-xxx"
                    ]
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Hardware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=FW13",
                "product": {
                  "name": "Firmware \u003c=FW13",
                  "product_id": "CSAFPID-21001"
                }
              },
              {
                "category": "product_version",
                "name": "FW14",
                "product": {
                  "name": "Firmware FW14",
                  "product_id": "CSAFPID-22001"
                }
              }
            ],
            "category": "product_family",
            "name": "Firmware"
          }
        ],
        "category": "vendor",
        "name": "Wago"
      }
    ],
    "product_groups": [
      {
        "group_id": "CSAFGID-0001",
        "product_ids": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004"
        ],
        "summary": "Affected products."
      },
      {
        "group_id": "CSAFGID-0002",
        "product_ids": [
          "CSAFPID-32001",
          "CSAFPID-32002"
        ],
        "summary": "Fixed products."
      }
    ],
    "relationships": [
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=FW13 installed on Controller BACnet/IP",
          "product_id": "CSAFPID-31001"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=FW13 installed on Controller BACnet MS/TP",
          "product_id": "CSAFPID-31002"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11002"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=FW13 installed on Ethernet Controller 3rd Generation",
          "product_id": "CSAFPID-31003"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=FW13 installed on Fieldbus Coupler Ethernet 3rd Generation",
          "product_id": "CSAFPID-31004"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11004"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware FW14 installed on Ethernet Controller 3rd Generation",
          "product_id": "CSAFPID-32001"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware FW14 installed on Fieldbus Coupler Ethernet 3rd Generation",
          "product_id": "CSAFPID-32002"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11004"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-10123",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "notes": [
        {
          "category": "description",
          "text": "An unautheticated remote attacker could send specifically crafted packets to a affected device. If an authenticated user then views that data in a specific page of the web-based management a buffer overflow will be triggered to gain full access of the device.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001",
          "CSAFPID-32002"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "If not needed, you can deactivate the web-based management to prevent attacks (command line). Disableunused TCP/UDP-ports. Restrict network access to the device. Do not directly connect the device to theinternet.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix for the affected firmwares will be provided with the following firmware versions:\n\n- FW14 installed on\u00a0750-352/xxx-xxx\n- FW14 installed on 750-88x/xxx-xxx\n- FW14 installed on 750-852\n\nNo fix planned for products:\n\n\u003c= FW13 installed on 750-831/xxx-xxx\n\n\u003c= FW13 installed on 750-829",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.8,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 8.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004"
          ]
        }
      ],
      "title": "CVE-2015-10123"
    },
    {
      "cve": "CVE-2018-25090",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "description",
          "text": "An unauthenticated remote attacker can use an XSS attack due to improper neutralization of input during web page generation. User interaction is required.\u00a0This leads to a limited impact of confidentiality and integrity but no impact of availability.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001",
          "CSAFPID-32002"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "If not needed, you can deactivate the web-based management to prevent attacks (command line). Disableunused TCP/UDP-ports. Restrict network access to the device. Do not directly connect the device to theinternet.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix for the affected firmwares will be provided with the following firmware versions:\n\n- FW14 installed on\u00a0750-352/xxx-xxx\n- FW14 installed on 750-88x/xxx-xxx\n- FW14 installed on 750-852\n\nNo fix planned for products:\n\n\u003c= FW13 installed on 750-831/xxx-xxx\n\n\u003c= FW13 installed on 750-829",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "environmentalScore": 5.4,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 5.4,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004"
          ]
        }
      ],
      "title": "CVE-2018-25090"
    }
  ]
}