CVE-2023-3379

Published: Nov 20, 2023Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Exploitability: 1.8 / Impact: 3.4

Source: info@cert.vde.com (Secondary)

Description

Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker to change the passwords of other non-admin users and thus to escalate non-root privileges.

Affected (13)

Products: Wago: Compact Controller 100 Firmware, Edge Controller Firmware, Pfc100 Firmware, Pfc200 Firmware, Touch Panel 600 Advanced Firmware, Touch Panel 600 Marine Firmware, Touch Panel 600 Standard Firmware

Wago

7 products

Compact Controller 100 Firmware

Edge Controller Firmware

Pfc100 Firmware

Pfc200 Firmware

Touch Panel 600 Advanced Firmware

Touch Panel 600 Marine Firmware

Touch Panel 600 Standard Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago Compact Controller 100 Firmware	Up to 25

Running on/with	Platform Versions
Wago Compact Controller 100	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago Edge Controller Firmware	Up to 25

Running on/with	Platform Versions
Wago Edge Controller	All versions

Configuration C

3 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago Pfc100 Firmware	Before 22
Wago Pfc100 Firmware	Version 22
Wago Pfc100 Firmware	Version 22 patch_1

Running on/with	Platform Versions
Wago Pfc100	All versions

Configuration D

5 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago Pfc200 Firmware	Before 22
Wago Pfc200 Firmware	Version 22
Wago Pfc200 Firmware	Version 22 patch_1
Wago Pfc200 Firmware	Version 23
Wago Pfc200 Firmware	Version 24

Running on/with	Platform Versions
Wago Pfc200	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago Touch Panel 600 Advanced Firmware	Up to 25

Running on/with	Platform Versions
Wago Touch Panel 600 Advanced	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago Touch Panel 600 Marine Firmware	Up to 25

Running on/with	Platform Versions
Wago Touch Panel 600 Marine	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago Touch Panel 600 Standard Firmware	Up to 25

Running on/with	Platform Versions
Wago Touch Panel 600 Standard	All versions

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (2)

https://cert.vde.com/en/advisories/VDE-2023-015/

Source: info@cert.vde.com

Third Party Advisory

https://cert.vde.com/en/advisories/VDE-2023-015/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.