Most recent entries from all

CVE-2023-1698 — WAGO: WBM Command Injection in multiple products

Affected: WAGO Compact Controller CC100, WAGO Edge Controller, WAGO PFC100, WAGO PFC200, WAGO Touch Panel 600 Advanced Line, WAGO Touch Panel 600 Marine Line, WAGO Touch Panel 600 Standard Line

In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behaviour, Denial of Service and full system compromise.

VDE-2023-007 — WAGO: Unauthenticated command execution via Web-based-management UPDATE A

The 'legal information' plugin of web-based-management contained a vulnerability which allowed execution of arbitrary commands with privileges of www user. UPDATE A 15.06.2023 :

Removed PFC100 with FW23 as affected product and from solution PFC200 with FW23 is only affected on 750-821x/xxx-xxx Renamed "FW22 Patch 1" to "FW22 SP1" to match the versions of the download portal