CVSS: 6.1EPSS: 0%CPEs: 28EXPL: 0CVE-2022-45137 – WAGO: Reflective Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-45137
The configuration backend of the web-based management is vulnerable to reflected XSS (Cross-Site Scripting) attacks that targets the users browser. This leads to a limited impact of confidentiality and integrity but no impact of availability. • https://cert.vde.com/en/advisories/VDE-2022-060 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-3843 – WAGO: Exposure of configuration interface in unmanaged switches
https://notcve.org/view.php?id=CVE-2022-3843
In WAGO Unmanaged Switch (852-111/000-001) in firmware version 01 an undocumented configuration interface without authorization allows an remote attacker to read system information and configure a limited set of parameters. • https://cert.vde.com/en/advisories/VDE-2022-055 • CWE-912: Hidden Functionality •
CVSS: 5.9EPSS: 0%CPEs: 14EXPL: 0CVE-2022-3738 – WAGO: Missing authentication for config export functionality in multiple products
https://notcve.org/view.php?id=CVE-2022-3738
The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like credentials and cryptographic material. A valid user has to create a backup after the last reboot for this attack to be successfull. La vulnerabilidad permite a un atacante remoto no autenticado descargar un archivo de copia de seguridad, si existe. Ese archivo de copia de seguridad puede contener información confidencial, como credenciales y material criptográfico. • https://cert.vde.com/en/advisories/VDE-2022-054 • CWE-306: Missing Authentication for Critical Function •
CVSS: 9.8EPSS: 0%CPEs: 245EXPL: 0CVE-2021-34569 – WAGO I/O-Check Service prone to Out-of-bounds Write
https://notcve.org/view.php?id=CVE-2021-34569
In WAGO I/O-Check Service in multiple products an attacker can send a specially crafted packet containing OS commands to crash the diagnostic tool and write memory. En WAGO I/O-Check Service en varios productos, un atacante puede enviar un paquete especialmente manipulado que contiene comandos del Sistema Operativo para bloquear la herramienta de diagnóstico y escribir en la memoria. • https://cert.vde.com/en/advisories/VDE-2020-036 • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 245EXPL: 0CVE-2021-34568 – WAGO I/O-Check Service prone to Allocation of Resources Without Limits or Throttling
https://notcve.org/view.php?id=CVE-2021-34568
In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to provoke a denial of service. En WAGO I/O-Check Service en varios productos, un atacante remoto no autenticado puede enviar un paquete especialmente manipulado que contiene comandos del Sistema Operativo para provocar una Denegación de Servicio (DoS). • https://cert.vde.com/en/advisories/VDE-2020-036 • CWE-770: Allocation of Resources Without Limits or Throttling •