Description
The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like credentials and cryptographic material. A valid user has to create a backup after the last reboot for this attack to be successfull.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WAGO | Series WAGO PFC100 | FW16 – ≤ FW22 | — |
| WAGO | Series WAGO PFC200 | FW16 – ≤ FW22 | — |
| WAGO | Series WAGO Touch Panel 600 Advanced Line | FW16 – ≤ FW22 | — |
| WAGO | Series WAGO Touch Panel 600 Marine Line | FW16 – ≤ FW22 | — |
| WAGO | Series WAGO Touch Panel 600 Standard Line | FW16 – ≤ FW22 | — |
| WAGO | WAGO Compact Controller CC100 | FW16 – ≤ FW22 | — |
| WAGO | WAGO Edge Controller | FW16 – ≤ FW22 | — |
Advisories 1
- VDE-2022-054 WAGO: Unauthenticated Configuration Export in web-based management in multiple devices CERT@VDE · Jan 12, 2023