CVSS: 5.3EPSS: 0%CPEs: 20EXPL: 0CVE-2023-3379 – WAGO: Improper Privilege Management in web-based management
https://notcve.org/view.php?id=CVE-2023-3379
Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker to change the passwords of other non-admin users and thus to escalate non-root privileges. La administración de múltiples productos basada en web de Wago tiene una vulnerabilidad que permite a un atacante autenticado local cambiar las contraseñas de otros usuarios que no sean administradores y así escalar privilegios no root. • https://cert.vde.com/en/advisories/VDE-2023-015 • CWE-269: Improper Privilege Management CWE-863: Incorrect Authorization •
CVSS: 10.0EPSS: 0%CPEs: 42EXPL: 0CVE-2020-12522 – Command Injection Vulnerability in I/O-Check Service of WAGO PFC100, PFC200 and Touch Panel 600 Series with firmware versions <=FW10
https://notcve.org/view.php?id=CVE-2020-12522
The reported vulnerability allows an attacker who has network access to the device to execute code with specially crafted packets in WAGO Series PFC 100 (750-81xx/xxx-xxx), Series PFC 200 (750-82xx/xxx-xxx), Series Wago Touch Panel 600 Standard Line (762-4xxx), Series Wago Touch Panel 600 Advanced Line (762-5xxx), Series Wago Touch Panel 600 Marine Line (762-6xxx) with firmware versions <=FW10. La vulnerabilidad reportada permite a un atacante que tiene acceso de red al dispositivo ejecutar código con paquetes especialmente diseñados en WAGO Serie PFC 100 (750-81xx/xxx-xxx), Series PFC 200 (750-82xx/xxx-xxx), Series Wago Touch Panel 600 Standard Line (762-4xxx), Series Wago Touch Panel 600 Advanced Line (762-5xxx), Series Wago Touch Panel 600 Marine Line (762-6xxx) con versiones de firmware anteriores a FW10 incluyéndola • https://cert.vde.com/en-us/advisories/vde-2020-045 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •