PT-2023-13534 · Wago · Wago Series Pfc100+13

Quentin Kaiser · Published 2023-01-19 · Updated 2023-11-07 · CVE-2022-3738

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Software (affected versions not specified)

Description The issue allows a remote unauthenticated attacker to download a backup file, if one exists. This backup file might contain sensitive information like credentials and cryptographic material. A valid user has to create a backup after the last reboot for this attack to be successful.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2022-3738

Affected Products

Wago Series Pfc100

Wago Series Pfc200

Wago Series Wago Touch Panel 600 Advanced Line

Wago Series Wago Touch Panel 600 Marine Line

Wago Series Wago Touch Panel 600 Standard Line

Compact Controller Cc100

Wago Edge Controller

Cc100 Firmware

Edge Controller Firmware

Pfc100 Firmware

Pfc200 Firmware

Touch Panel 600 Advanced Firmware

Touch Panel 600 Marine Firmware

Touch Panel 600 Standard Firmware

References · 5

• https://osv.dev/vulnerability/CVE-2022-3738 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3738 · Security Note
• https://cert.vde.com/en/advisories/VDE-2022-054 · Note
• https://t.me/cvenotify/42413 · Telegram Post
• https://t.me/cibsecurity/56713 · Telegram Post