Compact Controller 100 Firmware
CVE-2023-4089
LOW
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (cert) · only source for this CVE.
CVSS VectorVendor: cert
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
On affected Wago products an remote attacker with administrative privileges can access files to which he has already access to through an undocumented local file inclusion. This access is logged in a different log file than expected.
AnalysisAI
On affected Wago products an remote attacker with administrative privileges can access files to which he has already access to through an undocumented local file inclusion. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-610. On affected Wago products an remote attacker with administrative privileges can access files to which he has already access to through an undocumented local file inclusion. This access is logged in a different log file than expected. Affected products include: Wago Compact Controller 100 Firmware, Wago Edge Controller Firmware, Wago Pfc100 Firmware, Wago Pfc200 Firmware, Wago Touch Panel 600 Advanced Firmware.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change t
Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker to chang
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today