Wago
Wago Pfc100 Firmware: vulnerabilidades y CVE
Wago Pfc100 Firmware tiene 13 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 4 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE13
Últimos 12 meses0
Críticas4
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2023-3379 | Media (5.3) | 0.20% | — | 20 nov 2023 | Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker to change the passwords of other non-admin users and thus to escalate non-root privileges. |
| CVE-2023-4089 | Baja (2.7) | 0.47% | — | 17 oct 2023 | On affected Wago products an remote attacker with administrative privileges can access files to which he has already access to through an undocumented local file inclusion. This access is logged in a different log file… |
| CVE-2023-1698 | Crítica (9.8) | 82% | — | 15 may 2023 | In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behaviour, Denial of Service and full system… |
| CVE-2022-45140 | Crítica (9.8) | 1.1% | — | 27 feb 2023 | The configuration backend allows an unauthenticated user to write arbitrary data with root privileges to the storage, which could lead to unauthenticated remote code execution and full system compromise. |
| CVE-2022-45139 | Media (5.3) | 0.25% | — | 27 feb 2023 | A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of… |
| CVE-2022-45138 | Crítica (9.8) | 0.74% | — | 27 feb 2023 | The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API. The vulnerability allows an unauthenticated attacker to read… |
| CVE-2022-45137 | Media (6.1) | 0.38% | — | 27 feb 2023 | The configuration backend of the web-based management is vulnerable to reflected XSS (Cross-Site Scripting) attacks that targets the users browser. This leads to a limited impact of confidentiality and integrity but no… |
| CVE-2022-3738 | Media (5.9) | 0.63% | — | 19 ene 2023 | The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like credentials and cryptographic material. A valid user has to… |
| CVE-2019-5149 | Alta (7.5) | 1.8% | — | 11 mar 2020 | The WBM web application on firmwares prior to 03.02.02 and 03.01.07 on the WAGO PFC100 and PFC2000, respectively, runs on a lighttpd web server and makes use of the FastCGI module, which is intended to provide high… |
| CVE-2019-5135 | Media (5.3) | 1.0% | — | 11 mar 2020 | An exploitable timing discrepancy vulnerability exists in the authentication functionality of the Web-Based Management (WBM) web application on WAGO PFC100/200 controllers. The WBM application makes use of the PHP… |
| CVE-2019-5134 | Alta (7.5) | 2.3% | — | 11 mar 2020 | An exploitable regular expression without anchors vulnerability exists in the Web-Based Management (WBM) authentication functionality of WAGO PFC200 versions 03.00.39(12) and 03.01.07(13), and WAGO PFC100 version… |
| CVE-2019-5082 | Crítica (9.8) | 3.3% | — | 8 ene 2020 | An exploitable heap buffer overflow vulnerability exists in the iocheckd service I/O-Check functionality of WAGO PFC200 Firmware version 03.01.07(13), WAGO PFC200 Firmware version 03.00.39(12), and WAGO PFC100 Firmware… |
| CVE-2019-10953 | Alta (7.5) | 3.4% | — | 17 abr 2019 | ABB, Phoenix Contact, Schneider Electric, Siemens, WAGO - Programmable Logic Controllers, multiple versions. Researchers have found some controllers are susceptible to a denial-of-service attack due to a flood of… |