Description
The configuration backend of the web-based management is vulnerable to reflected XSS (Cross-Site Scripting) attacks that targets the users browser. This leads to a limited impact of confidentiality and integrity but no impact of availability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WAGO | Compact Controller CC100 (751-9301) | FW16 – < FW22, FW23 | FW22 |
| WAGO | Edge Controller (752-8303/8000-002) | FW18 – < FW22, FW23 | FW22 |
| WAGO | PFC100 (750-81xx/xxx-xxx) | FW16 – < FW22, FW23 | FW22 |
| WAGO | PFC200 (750-82xx/xxx-xxx) | FW16 – < FW22, FW23 | FW22 |
| WAGO | Touch Panel 600 Advanced Line (762-5xxx) | FW16 – < FW22, FW23 | FW22 |
| WAGO | Touch Panel 600 Marine Line (762-6xxx) | FW16 – < FW22, FW23 | FW22 |
| WAGO | Touch Panel 600 Standard Line (762-4xxx) | FW16 – < FW22, FW23 | FW22 |
Advisories 2
- VDE-2024-054 Endress+Hauser: Netilion Network Insights is affected by multiple vulnerabilities CERT@VDE · May 22, 2025
- VDE-2022-060 WAGO: Multiple vulnerabilities in web-based management of multiple products CERT@VDE · Feb 27, 2023