Wago
Wago Touch Panel 600 Advanced Firmware: vulnerabilidades y CVE
Wago Touch Panel 600 Advanced Firmware tiene 9 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 4 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE9
Últimos 12 meses0
Críticas4
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2023-3379 | Media (5.3) | 0.20% | — | 20 nov 2023 | Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker to change the passwords of other non-admin users and thus to escalate non-root privileges. |
| CVE-2023-4089 | Baja (2.7) | 0.47% | — | 17 oct 2023 | On affected Wago products an remote attacker with administrative privileges can access files to which he has already access to through an undocumented local file inclusion. This access is logged in a different log file… |
| CVE-2023-1698 | Crítica (9.8) | 82% | — | 15 may 2023 | In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behaviour, Denial of Service and full system… |
| CVE-2022-45140 | Crítica (9.8) | 1.1% | — | 27 feb 2023 | The configuration backend allows an unauthenticated user to write arbitrary data with root privileges to the storage, which could lead to unauthenticated remote code execution and full system compromise. |
| CVE-2022-45139 | Media (5.3) | 0.25% | — | 27 feb 2023 | A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of… |
| CVE-2022-45138 | Crítica (9.8) | 0.74% | — | 27 feb 2023 | The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API. The vulnerability allows an unauthenticated attacker to read… |
| CVE-2022-45137 | Media (6.1) | 0.38% | — | 27 feb 2023 | The configuration backend of the web-based management is vulnerable to reflected XSS (Cross-Site Scripting) attacks that targets the users browser. This leads to a limited impact of confidentiality and integrity but no… |
| CVE-2022-3738 | Media (5.9) | 0.63% | — | 19 ene 2023 | The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like credentials and cryptographic material. A valid user has to… |
| CVE-2020-12522 | Crítica (9.8) | 3.1% | — | 17 dic 2020 | The reported vulnerability allows an attacker who has network access to the device to execute code with specially crafted packets in WAGO Series PFC 100 (750-81xx/xxx-xxx), Series PFC 200 (750-82xx/xxx-xxx), Series Wago… |