Vulnerability · Published Feb 27, 2023 · Assigned by CERTVDE
CVE-2022-45139WAGO: Origin validation error through CORS misconfiguration
Medium 5.3
In plain English
A medium-severity security flaw in Compact Controller CC100 (751-9301) from WAGO. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).
Official description
A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of information readable the impact only affects a small subset of confidentiality.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WAGO | Compact Controller CC100 (751-9301) | FW16 – before FW22FW23 |
| WAGO | Edge Controller (752-8303/8000-002) | FW18 – before FW22FW23 |
| WAGO | PFC100 (750-81xx/xxx-xxx) | FW16 – before FW22FW23 |
| WAGO | PFC200 (750-82xx/xxx-xxx) | FW16 – before FW22FW23 |
| WAGO | Touch Panel 600 Advanced Line (762-5xxx) | FW16 – before FW22FW23 |
| WAGO | Touch Panel 600 Marine Line (762-6xxx) | FW16 – before FW22FW23 |
| WAGO | Touch Panel 600 Standard Line (762-4xxx) | FW16 – before FW22FW23 |
Weakness: CWE-346 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N