Description
Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker to change the passwords of other non-admin users and thus to escalate non-root privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WAGO | Compact Controller 100 (751-9301) | ≤ FW25 | — |
| WAGO | PFC100 (750-810x/xxx-xxx) | ≤ FW22 Patch 1 | — |
| WAGO | PFC200 (750-820x/xxx-xxx) | ≤ FW25 | — |
| WAGO | PFC200 (750-821x/xxx-xxx) | ≤ FW22 Patch 1 | — |
| WAGO | Touch Panel 600 Advanced Line (762-5xxx) | ≤ FW25 | — |
| WAGO | Touch Panel 600 Marine Line (762-6xxx) | ≤ FW25 | — |
| WAGO | Touch Panel 600 Standard Line (762-4xxx) | ≤ FW25 | — |
| Wago | Edge Controller (752-8303/8000-002) | ≤ FW25 | — |
Advisories 1
- VDE-2023-015 WAGO: Improper privilege management in web-based management CERT@VDE · Nov 20, 2023