Description
Various configuration pages of the device are vulnerable to reflected XSS (Cross-Site Scripting) attacks. An authorized attacker with user privileges may use this to gain access to confidential information on a PC that connects to the WBM after it has been compromised.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WAGO | Compact Controller CC100 (751-9301) | FW16 – < FW22 | FW22 |
| WAGO | Edge Controller (752-8303/8000-002) | FW16 – < FW22 | FW22 |
| WAGO | Series PFC100 (750-81xx/xxx-xxx) | FW16 – < FW22 | FW22 |
| WAGO | Series PFC200 (750-82xx/xxx-xxx) | FW16 – < FW22 | FW22 |
| WAGO | Series Touch Panel 600 Advanced Line (762-5xxx) | FW16 FW22 | — |
| WAGO | Series Touch Panel 600 Marine Line (762-6xxx) | FW16 FW22 | — |
| WAGO | Series Touch Panel 600 Standard Line (762-4xxx) | FW16 FW22 | — |
Advisories 1
- VDE-2022-004 WAGO: Web-Based Management Cross-Site Scripting CERT@VDE · Mar 9, 2022