var-202302-1899
Vulnerability from variot
The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API. The vulnerability allows an unauthenticated attacker to read and set several device parameters that can lead to full compromise of the device. 751-9301 firmware, 752-8303/8000-002 firmware, PFC100 firmware etc. WAGO The product contains a lack of authentication vulnerability for critical functionality.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-202302-1899", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "pfc200", "scope": "lt", "trust": 1.0, "vendor": "wago", "version": "22" }, { "model": "pfc200", "scope": "gte", "trust": 1.0, "vendor": "wago", "version": "16" }, { "model": "752-8303\\/8000-002", "scope": "eq", "trust": 1.0, "vendor": "wago", "version": "23" }, { "model": "pfc100", "scope": "eq", "trust": 1.0, "vendor": "wago", "version": "23" }, { "model": "touch panel 600 advanced", "scope": "eq", "trust": 1.0, "vendor": "wago", "version": "23" }, { "model": "touch panel 600 standard", "scope": "gte", "trust": 1.0, "vendor": "wago", "version": "16" }, { "model": "touch panel 600 standard", "scope": "lt", "trust": 1.0, "vendor": "wago", "version": "22" }, { "model": "751-9301", "scope": "eq", "trust": 1.0, "vendor": "wago", "version": "22" }, { "model": "pfc200", "scope": "eq", "trust": 1.0, "vendor": "wago", "version": "23" }, { "model": "touch panel 600 marine", "scope": "lt", "trust": 1.0, "vendor": "wago", "version": "22" }, { "model": "touch panel 600 marine", "scope": "eq", "trust": 1.0, "vendor": "wago", "version": "22" }, { "model": "touch panel 600 marine", "scope": "gte", "trust": 1.0, "vendor": "wago", "version": "16" }, { "model": "touch panel 600 advanced", "scope": "eq", "trust": 1.0, "vendor": "wago", "version": "22" }, { "model": "touch panel 600 advanced", "scope": "gte", "trust": 1.0, "vendor": "wago", "version": "16" }, { "model": "touch panel 600 standard", "scope": "eq", "trust": 1.0, "vendor": "wago", "version": "23" }, { "model": "751-9301", "scope": "lt", "trust": 1.0, "vendor": "wago", "version": "22" }, { "model": "752-8303\\/8000-002", "scope": "eq", "trust": 1.0, "vendor": "wago", "version": "22" }, { "model": "751-9301", "scope": "gte", "trust": 1.0, "vendor": "wago", "version": "16" }, { "model": "pfc100", "scope": "lt", "trust": 1.0, "vendor": "wago", "version": "22" }, { "model": "pfc100", "scope": "eq", "trust": 1.0, "vendor": "wago", "version": "22" }, { "model": "pfc200", "scope": "eq", "trust": 1.0, "vendor": "wago", "version": "22" }, { "model": "751-9301", "scope": "eq", "trust": 1.0, "vendor": "wago", "version": "23" }, { "model": "752-8303\\/8000-002", "scope": "gte", "trust": 1.0, "vendor": "wago", "version": "18" }, { "model": "752-8303\\/8000-002", "scope": "lt", "trust": 1.0, "vendor": "wago", "version": "22" }, { "model": "touch panel 600 advanced", "scope": "lt", "trust": 1.0, "vendor": "wago", "version": "22" }, { "model": "touch panel 600 standard", "scope": "eq", "trust": 1.0, "vendor": "wago", "version": "22" }, { "model": "pfc100", "scope": "gte", "trust": 1.0, "vendor": "wago", "version": "16" }, { "model": "touch panel 600 marine", "scope": "eq", "trust": 1.0, "vendor": "wago", "version": "23" }, { "model": "touch panel 600 advanced", "scope": null, "trust": 0.8, "vendor": "wago", "version": null }, { "model": "pfc200", "scope": null, "trust": 0.8, "vendor": "wago", "version": null }, { "model": "751-9301", "scope": null, "trust": 0.8, "vendor": "wago", "version": null }, { "model": "touch panel 600 marine", "scope": null, "trust": 0.8, "vendor": "wago", "version": null }, { "model": "pfc100", "scope": null, "trust": 0.8, "vendor": "wago", "version": null }, { "model": "touch panel 600 standard", "scope": null, "trust": 0.8, "vendor": "wago", "version": null }, { "model": "752-8303/8000-002", "scope": null, "trust": 0.8, "vendor": "wago", "version": null } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2022-019560" }, { "db": "NVD", "id": "CVE-2022-45138" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:wago:751-9301_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "22", "versionStartIncluding": "16", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:wago:751-9301_firmware:22:-:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:wago:751-9301_firmware:23:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:wago:751-9301:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:wago:752-8303\\/8000-002_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "22", "versionStartIncluding": "18", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:wago:752-8303\\/8000-002_firmware:22:-:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:wago:752-8303\\/8000-002_firmware:23:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:wago:752-8303\\/8000-002:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:wago:pfc100_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "22", "versionStartIncluding": "16", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:wago:pfc100_firmware:22:-:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:wago:pfc100_firmware:23:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:wago:pfc100:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:wago:pfc200_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "22", "versionStartIncluding": "16", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:wago:pfc200_firmware:22:-:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:wago:pfc200_firmware:23:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:wago:pfc200:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:wago:touch_panel_600_advanced_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "22", "versionStartIncluding": "16", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:wago:touch_panel_600_advanced_firmware:22:-:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:wago:touch_panel_600_advanced_firmware:23:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:wago:touch_panel_600_advanced:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:wago:touch_panel_600_marine_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "22", "versionStartIncluding": "16", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:wago:touch_panel_600_marine_firmware:22:-:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:wago:touch_panel_600_marine_firmware:23:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:wago:touch_panel_600_marine:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:wago:touch_panel_600_standard_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "22", "versionStartIncluding": "16", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:wago:touch_panel_600_standard_firmware:22:-:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:wago:touch_panel_600_standard_firmware:23:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:wago:touch_panel_600_standard:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" } ] } ], "sources": [ { "db": "NVD", "id": "CVE-2022-45138" } ] }, "cve": "CVE-2022-45138", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "NETWORK", "author": "info@cert.vde.com", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "exploitabilityScore": 3.9, "impactScore": 5.9, "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, { "attackComplexity": "Low", "attackVector": "Network", "author": "OTHER", "availabilityImpact": "High", "baseScore": 9.8, "baseSeverity": "Critical", "confidentialityImpact": "High", "exploitabilityScore": null, "id": "JVNDB-2022-019560", "impactScore": null, "integrityImpact": "High", "privilegesRequired": "None", "scope": "Unchanged", "trust": 0.8, "userInteraction": "None", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" } ], "severity": [ { "author": "info@cert.vde.com", "id": "CVE-2022-45138", "trust": 1.0, "value": "CRITICAL" }, { "author": "OTHER", "id": "JVNDB-2022-019560", "trust": 0.8, "value": "Critical" }, { "author": "CNNVD", "id": "CNNVD-202302-2138", "trust": 0.6, "value": "CRITICAL" } ] } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2022-019560" }, { "db": "NVD", "id": "CVE-2022-45138" }, { "db": "CNNVD", "id": "CNNVD-202302-2138" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API. The vulnerability allows an unauthenticated attacker to read and set several device parameters that can lead to full compromise of the device. 751-9301 firmware, 752-8303/8000-002 firmware, PFC100 firmware etc. WAGO The product contains a lack of authentication vulnerability for critical functionality.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state", "sources": [ { "db": "NVD", "id": "CVE-2022-45138" }, { "db": "JVNDB", "id": "JVNDB-2022-019560" }, { "db": "VULMON", "id": "CVE-2022-45138" } ], "trust": 1.71 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2022-45138", "trust": 3.3 }, { "db": "CERT@VDE", "id": "VDE-2022-060", "trust": 2.5 }, { "db": "JVNDB", "id": "JVNDB-2022-019560", "trust": 0.8 }, { "db": "CNNVD", "id": "CNNVD-202302-2138", "trust": 0.6 }, { "db": "VULMON", "id": "CVE-2022-45138", "trust": 0.1 } ], "sources": [ { "db": "VULMON", "id": "CVE-2022-45138" }, { "db": "JVNDB", "id": "JVNDB-2022-019560" }, { "db": "NVD", "id": "CVE-2022-45138" }, { "db": "CNNVD", "id": "CNNVD-202302-2138" } ] }, "id": "VAR-202302-1899", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VARIoT devices database", "id": null } ], "trust": 0.65716723 }, "last_update_date": "2023-12-18T12:14:57.218000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "Multiple WAGO product Fixes for access control error vulnerabilities", "trust": 0.6, "url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=226903" } ], "sources": [ { "db": "CNNVD", "id": "CNNVD-202302-2138" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-306", "trust": 1.0 }, { "problemtype": "Lack of authentication for critical features (CWE-306) [ others ]", "trust": 0.8 } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2022-019560" }, { "db": "NVD", "id": "CVE-2022-45138" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.5, "url": "https://cert.vde.com/en/advisories/vde-2022-060/" }, { "trust": 0.8, "url": "https://nvd.nist.gov/vuln/detail/cve-2022-45138" }, { "trust": 0.6, "url": "https://cxsecurity.com/cveshow/cve-2022-45138/" }, { "trust": 0.1, "url": "https://cwe.mitre.org/data/definitions/306.html" }, { "trust": 0.1, "url": "https://nvd.nist.gov" } ], "sources": [ { "db": "VULMON", "id": "CVE-2022-45138" }, { "db": "JVNDB", "id": "JVNDB-2022-019560" }, { "db": "NVD", "id": "CVE-2022-45138" }, { "db": "CNNVD", "id": "CNNVD-202302-2138" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "VULMON", "id": "CVE-2022-45138" }, { "db": "JVNDB", "id": "JVNDB-2022-019560" }, { "db": "NVD", "id": "CVE-2022-45138" }, { "db": "CNNVD", "id": "CNNVD-202302-2138" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2023-02-27T00:00:00", "db": "VULMON", "id": "CVE-2022-45138" }, { "date": "2023-10-26T00:00:00", "db": "JVNDB", "id": "JVNDB-2022-019560" }, { "date": "2023-02-27T15:15:11.317000", "db": "NVD", "id": "CVE-2022-45138" }, { "date": "2023-02-27T00:00:00", "db": "CNNVD", "id": "CNNVD-202302-2138" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2023-02-27T00:00:00", "db": "VULMON", "id": "CVE-2022-45138" }, { "date": "2023-10-26T05:47:00", "db": "JVNDB", "id": "JVNDB-2022-019560" }, { "date": "2023-03-07T22:54:12.070000", "db": "NVD", "id": "CVE-2022-45138" }, { "date": "2023-02-28T00:00:00", "db": "CNNVD", "id": "CNNVD-202302-2138" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-202302-2138" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "plural \u00a0WAGO\u00a0 Vulnerability related to lack of authentication for critical functions in the product", "sources": [ { "db": "JVNDB", "id": "JVNDB-2022-019560" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "access control error", "sources": [ { "db": "CNNVD", "id": "CNNVD-202302-2138" } ], "trust": 0.6 } }
Loading...
Loading...
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.