Description
A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of information readable the impact only affects a small subset of confidentiality.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WAGO | Compact Controller CC100 (751-9301) | FW16 – < FW22, FW23 | FW22 |
| WAGO | Edge Controller (752-8303/8000-002) | FW18 – < FW22, FW23 | FW22 |
| WAGO | PFC100 (750-81xx/xxx-xxx) | FW16 – < FW22, FW23 | FW22 |
| WAGO | PFC200 (750-82xx/xxx-xxx) | FW16 – < FW22, FW23 | FW22 |
| WAGO | Touch Panel 600 Advanced Line (762-5xxx) | FW16 – < FW22, FW23 | FW22 |
| WAGO | Touch Panel 600 Marine Line (762-6xxx) | FW16 – < FW22, FW23 | FW22 |
| WAGO | Touch Panel 600 Standard Line (762-4xxx) | FW16 – < FW22, FW23 | FW22 |
Advisories 2
- VDE-2024-054 Endress+Hauser: Netilion Network Insights is affected by multiple vulnerabilities CERT@VDE · May 22, 2025
- VDE-2022-060 WAGO: Multiple vulnerabilities in web-based management of multiple products CERT@VDE · Feb 27, 2023