Vulnerability · Published Nov 21, 2023 · Assigned by CERTVDE
CVE-2023-4149WAGO: OS Command Injection Vulnerability in Managed Switch
Critical 9.8
In plain English
A critical-severity OS command injection in Industrial Managed Switch (0852-0602) from WAGO. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.1%top 33.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A vulnerability in the web-based management allows an unauthenticated remote attacker to inject arbitrary system commands and gain full system control. Those commands are executed with root privileges. The vulnerability is located in the user request handling of the web-based management.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WAGO | Industrial Managed Switch (0852-0602) | 0 – before 1.0.6.S0 |
| WAGO | Industrial Managed Switch (0852-0603) | 0 – before 1.0.6.S0 |
| WAGO | Industrial Managed Switch (0852-1605) | 0 – before 1.2.5.S0 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H