Cross-Site Scripting Vulnerability in WAGO Ethernet Controllers
CVE-2018-16210

6.1MEDIUM

Key Information:

Vendor

Wago

Status
Wago 750-881 Ethernet Controller Devices Firmware
Vendor
CVE Published:
12 October 2018

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2018-16210?

WAGO 750-88X and WAGO 750-89X Ethernet Controller devices are susceptible to a Cross-Site Scripting (XSS) vulnerability in their SNMP configuration settings. This vulnerability occurs through the SNMP_DESC or SNMP_LOC_SNMP_CONT fields of the webserv/cplcfg/snmp.ssi interface. Attackers can exploit this flaw to inject malicious scripts into the web configurations, potentially leading to unauthorized access and data leakage.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2018-16210 - Proof of Concept

References

https://www.exploit-db.com/exploits/45581/
exploitx_refsource_EXPLOIT-DB

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.