WAGO PLCs WBM vulnerable to reflected XSS
CVE-2022-22511

5.4MEDIUM

Key Information:

Vendor
Wago
Status
Compact Controller Cc100 (751-9301)
Edge Controller (752-8303/8000-002)
Series Pfc100 (750-81xx/xxx-xxx)
Series Pfc200 (750-82xx/xxx-xxx)
Vendor
CVE Published:
9 March 2022

Summary

Various configuration pages of the device are vulnerable to reflected XSS (Cross-Site Scripting) attacks. An authorized attacker with user privileges may use this to gain access to confidential information on a PC that connects to the WBM after it has been compromised.

Affected Version(s)

Compact Controller CC100 (751-9301) FW16

Edge Controller (752-8303/8000-002) FW16

Series PFC100 (750-81xx/xxx-xxx) FW16

References

https://cert.vde.com/en/advisories/VDE-2022-004/
x_refsource_CONFIRM

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

These vulnerabilities were reported to WAGO by: Mohamed Magdy Abumuslim, coordination done by CERT@VDE.
.
CVE-2022-22511 : WAGO PLCs WBM vulnerable to reflected XSS | SecurityVulnerability.io