PT-2022-6077 · Wago · Wago Pfc100/Pfc200+3

Published 2022-10-17 · Updated 2022-11-04 · CVE-2022-3281

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions WAGO PFC100/PFC200 versions (affected versions not specified) WAGO Touch Panel 600 versions (affected versions not specified) WAGO Compact Controller CC100 versions (affected versions not specified) WAGO Edge Controller versions (affected versions not specified)

Description The issue is related to an incorrectly implemented MAC address filtering function in the software of WAGO programmable logic controllers and touch panel devices. This may allow a remote attacker to bypass security restrictions after a reboot, potentially reaching a network that should be protected by the MAC address filter.

Recommendations For WAGO PFC100/PFC200, consider disabling the MAC address filtering function until a patch is available. For WAGO Touch Panel 600, restrict access to the network until the issue is resolved. For WAGO Compact Controller CC100 and Edge Controller, avoid using the devices in sensitive networks until a fix is provided. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-440

Related Identifiers

BDU:2023-00012

CVE-2022-3281

Affected Products

Compact Controller Cc100

Wago Edge Controller

Wago Pfc100/Pfc200

Wago Touch Panel 600

References · 5

• https://osv.dev/vulnerability/CVE-2022-3281 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3281 · Security Note
• https://bdu.fstec.ru/vul/2023-00012 · Security Note
• https://t.me/cibsecurity/51543 · Telegram Post
• https://cert.vde.com/en/advisories/VDE-2022-042 · Note