What is CVE-2023-4149?

CVE-2023-4149 is a critical-severity vulnerability in Wago 0852-0602, classified under OS Command Injection. CVSS score: 9.8/10. Published 2023-11-21.

How severe is CVE-2023-4149?

Critical severity. CVSS v3 base score is 9.8 out of 10.

RCE in Wago 0852-0602

CVE-2023-4149

A vulnerability in the web-based management allows an unauthenticated remote attacker to inject arbitrary system commands and gain full system control. Those commands are executed with root privileges. The vulnerability is located in the user request handling of the web-based management.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.011 (62.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Wago 0852-0602
Wago 0852-0602_firmware
Wago 0852-0603
Wago 0852-0603_firmware
Wago 0852-1605
Wago 0852-1605_firmware
Wago Industrial Managed Switch (0852-0602) — versions 0
Wago Industrial Managed Switch (0852-0603) — versions 0
Wago Industrial Managed Switch (0852-1605) — versions 0

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

info@cert.vde.com (Third Party Advisory)

Frequently asked questions

What is CVE-2023-4149?: CVE-2023-4149 is a critical-severity vulnerability in Wago 0852-0602, classified under OS Command Injection. CVSS score: 9.8/10. Published 2023-11-21.
How severe is CVE-2023-4149?: Critical severity. CVSS v3 base score is 9.8 out of 10.