Description (CNA)
A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of information readable the impact only affects a small subset of confidentiality.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| WAGO / Compact Controller CC100 (751-9301) | affected FW16 before FW22; unaffected FW22 Patch 1; affected FW23 |
| WAGO / Edge Controller (752-8303/8000-002) | affected FW18 before FW22; unaffected FW22 Patch 1; affected FW23 |
| WAGO / PFC100 (750-81xx/xxx-xxx) | affected FW16 before FW22; unaffected FW22 Patch 1; affected FW23 |
| WAGO / PFC200 (750-82xx/xxx-xxx) | affected FW16 before FW22; unaffected FW22 Patch 1; affected FW23 |
| WAGO / Touch Panel 600 Advanced Line (762-5xxx) | affected FW16 before FW22; unaffected FW22 Patch 1; affected FW23 |
| WAGO / Touch Panel 600 Marine Line (762-6xxx) | affected FW16 before FW22; unaffected FW22 Patch 1; affected FW23 |
| WAGO / Touch Panel 600 Standard Line (762-4xxx) | affected FW16 before FW22; unaffected FW22 Patch 1; affected FW23 |
CWE
CWE-346
References
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.