CVE-2022-45137

WAGO: Reflective Cross-Site Scripting

Medium6.1EPSS 0.38%

Published: 27 Feb 2023
Updated: 3 Aug 2024
Reserved: 10 Nov 2022
Assigned by: CERTVDE

Description

The configuration backend of the web-based management is vulnerable to reflected XSS (Cross-Site Scripting) attacks that targets the users browser. This leads to a limited impact of confidentiality and integrity but no impact of availability.

Scores

CVSS scores of CVE-2022-45137, by who scored it
Scored by	CVSS	Score	Vector
CERTVDECNA (assigner)	3.1	Medium6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVDNVD · Modified	3.1	Medium6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS (exploitation in 30 days): 0.38% · top 68% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.1.

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (opens in a new tab)All about CWE-79 and its CVEs

Affected products

WAGO · Compact Controller CC100 (751-9301)
- affected FW16 – < FW22
- unaffected FW22 Patch 1
- affected FW23
WAGO · Edge Controller (752-8303/8000-002)
- affected FW18 – < FW22
- unaffected FW22 Patch 1
- affected FW23
WAGO · PFC100 (750-81xx/xxx-xxx)
- affected FW16 – < FW22
- unaffected FW22 Patch 1
- affected FW23
WAGO · PFC200 (750-82xx/xxx-xxx)
- affected FW16 – < FW22
- unaffected FW22 Patch 1
- affected FW23
WAGO · Touch Panel 600 Advanced Line (762-5xxx)
- affected FW16 – < FW22
- unaffected FW22 Patch 1
- affected FW23
WAGO · Touch Panel 600 Marine Line (762-6xxx)
- affected FW16 – < FW22
- unaffected FW22 Patch 1
- affected FW23
WAGO · Touch Panel 600 Standard Line (762-4xxx)
- affected FW16 – < FW22
- unaffected FW22 Patch 1
- affected FW23

References (1)

https://cert.vde.com/en/advisories/VDE-2022-060/ (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-45137](https://trackcve.app/badge/CVE-2022-45137.svg)](https://trackcve.app/cve/CVE-2022-45137)

Record last updated 3 Aug 2024, 14:09 UTC.