A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a lim
A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of information readable the impact only affects a small subset of confidentiality.
| Vendor | Product | Versions |
|---|---|---|
| WAGO | Compact Controller CC100 (751 | 9301) — FW16, FW22 Patch 1, FW23 |
| WAGO | Edge Controller (752 | 8303/8000-002) — FW18, FW22 Patch 1, FW23 |
| WAGO | PFC100 (750 | 81xx/xxx-xxx) — FW16, FW22 Patch 1, FW23 |
| WAGO | PFC200 (750 | 82xx/xxx-xxx) — FW16, FW22 Patch 1, FW23 |
| WAGO | Touch Panel 600 Advanced Line (762 | 5xxx) — FW16, FW22 Patch 1, FW23 |
| WAGO | Touch Panel 600 Marine Line (762 | 6xxx) — FW16, FW22 Patch 1, FW23 |
| WAGO | Touch Panel 600 Standard Line (762 | 4xxx) — FW16, FW22 Patch 1, FW23 |
Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.
For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.
Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.