github - ghsa-9qfw-f49w-5jg7

ghsa-9qfw-f49w-5jg7

Vulnerability from github

Published

2022-10-17 12:00

Modified

2022-10-17 12:00

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Details

WAGO Series PFC100/PFC200, Series Touch Panel 600, Compact Controller CC100 and Edge Controller in multiple versions are prone to a loss of MAC-Address-Filtering after reboot. This may allow an remote attacker to circumvent the reach the network that should be protected by the MAC address filter.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-3281"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-440"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-10-17T09:15:00Z",
    "severity": "MODERATE"
  },
  "details": "WAGO Series PFC100/PFC200, Series Touch Panel 600, Compact Controller CC100 and Edge Controller in multiple versions are prone to a loss of MAC-Address-Filtering after reboot. This may allow an remote attacker to circumvent the reach the network that should be protected by the MAC address filter.",
  "id": "GHSA-9qfw-f49w-5jg7",
  "modified": "2022-10-17T12:00:27Z",
  "published": "2022-10-17T12:00:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3281"
    },
    {
      "type": "WEB",
      "url": "https://cert.vde.com/en/advisories/VDE-2022-042"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

cve-2022-3281

Vulnerability from cvelistv5

Published

2022-10-17 08:20

Modified

2024-09-16 22:45

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Summary

WAGO: multiple products - Loss of MAC-Address-Filtering after reboot

References

▼	URL	Tags
	https://cert.vde.com/en/advisories/VDE-2022-042/

Impacted products

▼	Vendor	Product
	WAGO	750-81xx/xxx-xxx Series PFC100/PFC200
	WAGO	750-8217/xxx-xxx Series PFC100/PFC200
	WAGO	750-82xx/xxx-xxx Series PFC100/PFC200
	WAGO	Compact Controller CC100
	WAGO	762-4xxx Series Touch Panel 600
	WAGO	762-5xxx Series Touch Panel 600
	WAGO	762-6xxx Series Touch Panel 600
	WAGO	752-8303/8000-002 Edge Controller

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:07:06.534Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert.vde.com/en/advisories/VDE-2022-042/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "750-81xx/xxx-xxx Series PFC100/PFC200",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThanOrEqual": "03.10.08(22)",
              "status": "affected",
              "version": "03.01.07(13)",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "750-8217/xxx-xxx Series PFC100/PFC200",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThanOrEqual": "03.10.08(22)",
              "status": "affected",
              "version": "03.04.10(16)",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "750-82xx/xxx-xxx Series PFC100/PFC200",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThanOrEqual": "03.10.08(22)",
              "status": "affected",
              "version": "03.01.07(13)",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Compact Controller CC100",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThanOrEqual": "03.09.08(21)",
              "status": "affected",
              "version": "03.07.17(19)",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "762-4xxx Series Touch Panel 600",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThanOrEqual": "03.10.09(22)",
              "status": "affected",
              "version": "03.01.07(13)",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "762-5xxx Series Touch Panel 600",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThanOrEqual": "03.10.09(22)",
              "status": "affected",
              "version": "03.01.07(13)",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "762-6xxx Series Touch Panel 600",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThanOrEqual": "03.10.09(22)",
              "status": "affected",
              "version": "03.01.07(13)",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "752-8303/8000-002 Edge Controller",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThanOrEqual": "03.10.09(22)",
              "status": "affected",
              "version": "03.06.09(18)",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2022-10-17T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "WAGO Series PFC100/PFC200, Series Touch Panel 600, Compact Controller CC100 and Edge Controller in multiple versions are prone to a loss of MAC-Address-Filtering after reboot. This may allow an remote attacker to circumvent the reach the network that should be protected by the MAC address filter."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-440",
              "description": "CWE-440 Expected Behavior Violation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-11-02T00:00:00",
        "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
        "shortName": "CERTVDE"
      },
      "references": [
        {
          "url": "https://cert.vde.com/en/advisories/VDE-2022-042/"
        }
      ],
      "source": {
        "advisory": "VDE-2022-042",
        "defect": [
          "CERT@VDE#64236"
        ],
        "discovery": "INTERNAL"
      },
      "title": "WAGO: multiple products - Loss of MAC-Address-Filtering after reboot",
      "x_generator": {
        "engine": "vulnogram 0.1.0-rc1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
    "assignerShortName": "CERTVDE",
    "cveId": "CVE-2022-3281",
    "datePublished": "2022-10-17T08:20:12.389049Z",
    "dateReserved": "2022-09-23T00:00:00",
    "dateUpdated": "2024-09-16T22:45:25.926Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted