CVE-2022-45138
WAGO: Missing Authentication for Critical Function
- Published
- Updated
- Reserved
- Assigned by
- CERTVDE
Description
The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API. The vulnerability allows an unauthenticated attacker to read and set several device parameters that can lead to full compromise of the device.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CERTVDECNA (assigner) | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.74% · top 45% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Weakness
Affected products
WAGO · Compact Controller CC100 (751-9301)
- affected FW16 – < FW22
- unaffected FW22 Patch 1
- affected FW23
WAGO · Edge Controller (752-8303/8000-002)
- affected FW18 – < FW22
- unaffected FW22 Patch 1
- affected FW23
WAGO · PFC100 (750-81xx/xxx-xxx)
- affected FW16 – < FW22
- unaffected FW22 Patch 1
- affected FW23
WAGO · PFC200 (750-82xx/xxx-xxx)
- affected FW16 – < FW22
- unaffected FW22 Patch 1
- affected FW23
WAGO · Touch Panel 600 Advanced Line (762-5xxx)
- affected FW16 – < FW22
- unaffected FW22 Patch 1
- affected FW23
WAGO · Touch Panel 600 Marine Line (762-6xxx)
- affected FW16 – < FW22
- unaffected FW22 Patch 1
- affected FW23
WAGO · Touch Panel 600 Standard Line (762-4xxx)
- affected FW16 – < FW22
- unaffected FW22 Patch 1
- affected FW23
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-45138)Record last updated .