Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 23:17:07 +0000 CVE-2022-45140 — WAGO: Missing Authentication for Critical Function https://cve.radiocsirt.org/vuln/cve-2022-45140 <p><strong>Affected:</strong> WAGO Compact Controller CC100 (751-9301), WAGO Edge Controller (752-8303/8000-002), WAGO PFC100 (750-81xx/xxx-xxx), WAGO PFC200 (750-82xx/xxx-xxx), WAGO Touch Panel 600 Advanced Line (762-5xxx), WAGO Touch Panel 600 Marine Line (762-6xxx), WAGO Touch Panel 600 Standard Line (762-4xxx)</p> <p>The configuration backend allows an unauthenticated user to write arbitrary data with root privileges to the storage, which could lead to unauthenticated remote code execution and full system compromise.</p> <p><strong>Affected:</strong> WAGO Compact Controller CC100 (751-9301), WAGO Edge Controller (752-8303/8000-002), WAGO PFC100 (750-81xx/xxx-xxx), WAGO PFC200 (750-82xx/xxx-xxx), WAGO Touch Panel 600 Advanced Line (762-5xxx), WAGO Touch Panel 600 Marine Line (762-6xxx), WAGO Touch Panel 600 Standard Line (762-4xxx)</p> <p>The configuration backend allows an unauthenticated user to write arbitrary data with root privileges to the storage, which could lead to unauthenticated remote code execution and full system compromise.</p> https://cve.radiocsirt.org/vuln/cve-2022-45140 VDE-2022-060 — WAGO: Multiple vulnerabilities in web-based management of multiple products https://cve.radiocsirt.org/vuln/vde-2022-060 <p>The Web-Based Management (WBM) of WAGOs programmable logic controller (PLC) is typically used for administration, commissioning and updates. The configuration backend can in some cases be used without authentication and to write data with root privileges. Additionally, the web-based management suffers a CORS misconfiguration and allows reflected XSS (Cross-Site Scripting) attacks.</p> <p>The Web-Based Management (WBM) of WAGOs programmable logic controller (PLC) is typically used for administration, commissioning and updates. The configuration backend can in some cases be used without authentication and to write data with root privileges. Additionally, the web-based management suffers a CORS misconfiguration and allows reflected XSS (Cross-Site Scripting) attacks.</p> https://cve.radiocsirt.org/vuln/vde-2022-060