CVE-2023-1698

Published: May 15, 2023Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: info@cert.vde.com (Secondary)

Description

In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behaviour, Denial of Service and full system compromise.

Affected (7)

Products: Wago: Compact Controller 100 Firmware, Edge Controller Firmware, Pfc100 Firmware, Pfc200 Firmware, Touch Panel 600 Advanced Firmware, Touch Panel 600 Marine Firmware, Touch Panel 600 Standard Firmware

Wago

7 products

Compact Controller 100 Firmware

Edge Controller Firmware

Pfc100 Firmware

Pfc200 Firmware

Touch Panel 600 Advanced Firmware

Touch Panel 600 Marine Firmware

Touch Panel 600 Standard Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago Compact Controller 100 Firmware	From 20 to 23

Running on/with	Platform Versions
Wago Compact Controller 100	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago Edge Controller Firmware	Version 22

Running on/with	Platform Versions
Wago Edge Controller	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago Pfc100 Firmware	From 20 to 23

Running on/with	Platform Versions
Wago Pfc100	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago Pfc200 Firmware	From 20 to 23

Running on/with	Platform Versions
Wago Pfc200	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago Touch Panel 600 Advanced Firmware	Version 22

Running on/with	Platform Versions
Wago Touch Panel 600 Advanced	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago Touch Panel 600 Marine Firmware	Version 22

Running on/with	Platform Versions
Wago Touch Panel 600 Marine	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago Touch Panel 600 Standard Firmware	Version 22

Running on/with	Platform Versions
Wago Touch Panel 600 Standard	All versions

Related CWEs

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (2)

https://cert.vde.com/en/advisories/VDE-2023-007/

Source: info@cert.vde.com

Third Party Advisory

https://cert.vde.com/en/advisories/VDE-2023-007/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.