CVE-2022-45140 — WAGO: Missing Authentication for Critical Function

Description (CNA)

The configuration backend allows an unauthenticated user to write arbitrary data with root privileges to the storage, which could lead to unauthenticated remote code execution and full system compromise.

Affected (CNA)

Vendor / product	Versions
WAGO / Compact Controller CC100 (751-9301)	affected FW16 before FW22; unaffected FW22 Patch 1; affected FW23
WAGO / Edge Controller (752-8303/8000-002)	affected FW16 before FW22; unaffected FW22 Patch 1; affected FW23
WAGO / PFC100 (750-81xx/xxx-xxx)	affected FW16 before FW22; unaffected FW22 Patch 1; affected FW23
WAGO / PFC200 (750-82xx/xxx-xxx)	affected FW16 before FW22; unaffected FW22 Patch 1; affected FW23
WAGO / Touch Panel 600 Advanced Line (762-5xxx)	affected FW16 before FW22; unaffected FW22 Patch 1; affected FW23
WAGO / Touch Panel 600 Marine Line (762-6xxx)	affected FW16 before FW22; unaffected FW22 Patch 1; affected FW23
WAGO / Touch Panel 600 Standard Line (762-4xxx)	affected FW16 before FW22; unaffected FW22 Patch 1; affected FW23

CWE

CWE-306

References

https://cert.vde.com/en/advisories/VDE-2022-060/

ADP enrichment

CVE

No English description supplied.

https://cert.vde.com/en/advisories/VDE-2022-060/

CISA-ADP

No English description supplied.

No references supplied.