Vulnerability · Published May 15, 2023 · Assigned by CERTVDE
CVE-2023-1698WAGO: WBM Command Injection in multiple products
Critical 9.8
In plain English
A critical-severity OS command injection in Compact Controller CC100 from WAGO. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 81.9% (higher than 99.7% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)81.9%top 0.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling2Nuclei, Public PoC
Official description
In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behaviour, Denial of Service and full system compromise.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WAGO | Compact Controller CC100 | FW20 – through FW22FW23 |
| WAGO | Edge Controller | FW22 |
| WAGO | PFC100 | FW20 – through FW22FW23 |
| WAGO | PFC200 | FW20 – through FW22FW23 |
| WAGO | Touch Panel 600 Advanced Line | FW22 |
| WAGO | Touch Panel 600 Marine Line | FW22 |
| WAGO | Touch Panel 600 Standard Line | FW22 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H