PT-2023-1576 · Wago · Wago Unmanaged Switch

Published 2023-02-16 · Updated 2023-02-24 · CVE-2022-3843

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions WAGO Unmanaged Switch (852-111/000-001) version 01

Description The issue is related to an undocumented configuration interface in the WAGO Unmanaged Switch that lacks authorization, allowing a remote attacker to read system information and configure a limited set of parameters. This can lead to unauthorized access to protected information.

Recommendations For version 01, consider disabling access to the undocumented configuration interface until a patch is available. Restrict remote access to the switch to minimize the risk of exploitation. Avoid using the switch until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Hidden Functionality

Weakness Enumeration

CWE-912

Related Identifiers

BDU:2023-01059

CVE-2022-3843

Affected Products

Wago Unmanaged Switch

References · 6

• https://osv.dev/vulnerability/CVE-2022-3843 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01059 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-3843 · Security Note
• https://t.me/cibsecurity/58326 · Telegram Post
• https://cert.vde.com/en/advisories/VDE-2022-055 · Note
• https://t.me/cvenotify/44466 · Telegram Post