QwikSec

Security Database

CVE

CWE

Training

CVE-2022-45137

Published: Feb 27, 2023

Modified: Aug 3, 2024

PUBLISHED

CVSS v3.1

6.1

MEDIUM

Description

The configuration backend of the web-based management is vulnerable to reflected XSS (Cross-Site Scripting) attacks that targets the users browser. This leads to a limited impact of confidentiality and integrity but no impact of availability.

Vendor	Product	Versions
WAGO	Compact Controller CC100 (751-9301)	affected `FW16 - < FW22` unaffected `FW22 Patch 1` affected `FW23`
WAGO	Edge Controller (752-8303/8000-002)	affected `FW18 - < FW22` unaffected `FW22 Patch 1` affected `FW23`
WAGO	PFC100 (750-81xx/xxx-xxx)	affected `FW16 - < FW22` unaffected `FW22 Patch 1` affected `FW23`
WAGO	PFC200 (750-82xx/xxx-xxx)	affected `FW16 - < FW22` unaffected `FW22 Patch 1` affected `FW23`
WAGO	Touch Panel 600 Advanced Line (762-5xxx)	affected `FW16 - < FW22` unaffected `FW22 Patch 1` affected `FW23`
WAGO	Touch Panel 600 Marine Line (762-6xxx)	affected `FW16 - < FW22` unaffected `FW22 Patch 1` affected `FW23`
WAGO	Touch Panel 600 Standard Line (762-4xxx)	affected `FW16 - < FW22` unaffected `FW22 Patch 1` affected `FW23`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

References

https://cert.vde.com/en/advisories/VDE-2022-060/

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.