WAGO: Improper Privilege Management in web-based management
CVE-2023-3379

5.3MEDIUM

Key Information:

Vendor

Wago

Status
Compact Controller 100 (751-9301)
Pfc100 (750-810x/xxx-xxx)
Pfc200 (750-820x/xxx-xxx)
Pfc200 (750-821x/xxx-xxx)
Vendor
CVE Published:
20 November 2023

What is CVE-2023-3379?

Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker to change the passwords of other non-admin users and thus to escalate non-root privileges.

Affected Version(s)

Compact Controller 100 (751-9301) 0

Edge Controller (752-8303/8000-002) 0

PFC100 (750-810x/xxx-xxx) 0

References

https://cert.vde.com/en/advisories/VDE-2023-015/

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Panagiotis Bellonias from Secura
.
CVE-2023-3379 : WAGO: Improper Privilege Management in web-based management