Wago Pfc100_firmware
13 CVEs affecting Wago Pfc100_firmware. Latest disclosed: 2023-11-20. Critical: 4, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-1698 | Critical | 9.8 | 2023-05-15 | In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can resul… |
CVE-2022-45140 | Critical | 9.8 | 2023-02-27 | The configuration backend allows an unauthenticated user to write arbitrary data with root privileges to the storage, which could lead to unauthenticated remot… |
CVE-2022-45138 | Critical | 9.8 | 2023-02-27 | The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API. Th… |
CVE-2019-5082 | Critical | 9.8 | 2020-01-08 | An exploitable heap buffer overflow vulnerability exists in the iocheckd service I/O-Check functionality of WAGO PFC200 Firmware version 03.01.07(13), WAGO PFC… |
CVE-2019-5149 | High | 7.5 | 2020-03-11 | The WBM web application on firmwares prior to 03.02.02 and 03.01.07 on the WAGO PFC100 and PFC2000, respectively, runs on a lighttpd web server and makes use o… |
CVE-2019-5134 | High | 7.5 | 2020-03-11 | An exploitable regular expression without anchors vulnerability exists in the Web-Based Management (WBM) authentication functionality of WAGO PFC200 versions 0… |
CVE-2019-10953 | High | 7.5 | 2019-04-17 | ABB, Phoenix Contact, Schneider Electric, Siemens, WAGO - Programmable Logic Controllers, multiple versions. Researchers have found some controllers are suscep… |
CVE-2022-45137 | Medium | 6.1 | 2023-02-27 | The configuration backend of the web-based management is vulnerable to reflected XSS (Cross-Site Scripting) attacks that targets the users browser. This leads… |
CVE-2022-3738 | Medium | 5.9 | 2023-01-19 | The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like… |
CVE-2023-3379 | Medium | 5.3 | 2023-11-20 | Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker to change the passwords of other non-admin use… |
CVE-2022-45139 | Medium | 5.3 | 2023-02-27 | A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combina… |
CVE-2019-5135 | Medium | 5.3 | 2020-03-11 | An exploitable timing discrepancy vulnerability exists in the authentication functionality of the Web-Based Management (WBM) web application on WAGO PFC100/200… |
CVE-2023-4089 | Low | 2.7 | 2023-10-17 | On affected Wago products an remote attacker with administrative privileges can access files to which he has already access to through an undocumented local fi… |