CVE-2022-3738 — WAGO: Missing authentication for config export functionality in multiple products

Description (CNA)

The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like credentials and cryptographic material. A valid user has to create a backup after the last reboot for this attack to be successfull.

Affected (CNA)

Vendor / product	Versions
WAGO / Series WAGO PFC100	affected FW16 through FW22
WAGO / Series WAGO PFC200	affected FW16 through FW22
WAGO / Series WAGO Touch Panel 600 Advanced Line	affected FW16 through FW22
WAGO / Series WAGO Touch Panel 600 Marine Line	affected FW16 through FW22
WAGO / Series WAGO Touch Panel 600 Standard Line	affected FW16 through FW22
WAGO / WAGO Compact Controller CC100	affected FW16 through FW22
WAGO / WAGO Edge Controller	affected FW16 through FW22

CWE

CWE-306

References

https://cert.vde.com/en/advisories/VDE-2022-054/

ADP enrichment

CVE

No English description supplied.

https://cert.vde.com/en/advisories/VDE-2022-054/

CISA-ADP

No English description supplied.

No references supplied.