title: WAGO: Missing Authentication for Critical Function
description: The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API. The vulnerability allows an unauthenticated attacker to read and set several device parameters that can lead to full compromise of the device.
problem types: CWE-306 Missing Authentication for Critical Function
affected:
{
defaultStatus: unaffected
product: Compact Controller CC100 (751-9301)
vendor: WAGO
versions:
lessThan: FW22, status: affected, version: FW16, versionType: custom
status: unaffected, version: FW22 Patch 1
status: affected, version: FW23
}
{
defaultStatus: unaffected
product: Edge Controller (752-8303/8000-002)
vendor: WAGO
versions:
lessThan: FW22, status: affected, version: FW18, versionType: custom
status: unaffected, version: FW22 Patch 1
status: affected, version: FW23
}
{
defaultStatus: unaffected
product: PFC100 (750-81xx/xxx-xxx)
vendor: WAGO
versions:
lessThan: FW22, status: affected, version: FW16, versionType: custom
status: unaffected, version: FW22 Patch 1
status: affected, version: FW23
}
{
defaultStatus: unaffected
product: PFC200 (750-82xx/xxx-xxx)
vendor: WAGO
versions:
lessThan: FW22, status: affected, version: FW16, versionType: custom
status: unaffected, version: FW22 Patch 1
status: affected, version: FW23
}
{
defaultStatus: unaffected
product: Touch Panel 600 Advanced Line (762-5xxx)
vendor: WAGO
versions:
lessThan: FW22, status: affected, version: FW16, versionType: custom
status: unaffected, version: FW22 Patch 1
status: affected, version: FW23
}
{
defaultStatus: unaffected
product: Touch Panel 600 Marine Line (762-6xxx)
vendor: WAGO
versions:
lessThan: FW22, status: affected, version: FW16, versionType: custom
status: unaffected, version: FW22 Patch 1
status: affected, version: FW23
}
{
defaultStatus: unaffected
product: Touch Panel 600 Standard Line (762-4xxx)
vendor: WAGO
versions:
lessThan: FW22, status: affected, version: FW16, versionType: custom
status: unaffected, version: FW22 Patch 1
status: affected, version: FW23
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL