CVSS: 9.8EPSS: 91%CPEs: 14EXPL: 4CVE-2023-1698 – WAGO: WBM Command Injection in multiple products
https://notcve.org/view.php?id=CVE-2023-1698
In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behaviour, Denial of Service and full system compromise. • https://github.com/codeb0ss/CVE-2023-1698-PoC https://github.com/Chocapikk/CVE-2023-1698 https://github.com/thedarknessdied/WAGO-CVE-2023-1698 https://github.com/deIndra/CVE-2023-1698 https://cert.vde.com/en/advisories/VDE-2023-007 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 5.9EPSS: 0%CPEs: 14EXPL: 0CVE-2022-3738 – WAGO: Missing authentication for config export functionality in multiple products
https://notcve.org/view.php?id=CVE-2022-3738
The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like credentials and cryptographic material. A valid user has to create a backup after the last reboot for this attack to be successfull. La vulnerabilidad permite a un atacante remoto no autenticado descargar un archivo de copia de seguridad, si existe. Ese archivo de copia de seguridad puede contener información confidencial, como credenciales y material criptográfico. • https://cert.vde.com/en/advisories/VDE-2022-054 • CWE-306: Missing Authentication for Critical Function •