Back
CVE-2022-45140
WAGO: Missing Authentication for Critical Function
Critical9.8EPSS 1.1%
- Published
- Updated
- Reserved
- Assigned by
- CERTVDE
Description
The configuration backend allows an unauthenticated user to write arbitrary data with root privileges to the storage, which could lead to unauthenticated remote code execution and full system compromise.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CERTVDECNA (assigner) | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 1.1% · top 35% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Weakness
Affected products
WAGO · Compact Controller CC100 (751-9301)
- affected FW16 – < FW22
- unaffected FW22 Patch 1
- affected FW23
WAGO · Edge Controller (752-8303/8000-002)
- affected FW16 – < FW22
- unaffected FW22 Patch 1
- affected FW23
WAGO · PFC100 (750-81xx/xxx-xxx)
- affected FW16 – < FW22
- unaffected FW22 Patch 1
- affected FW23
WAGO · PFC200 (750-82xx/xxx-xxx)
- affected FW16 – < FW22
- unaffected FW22 Patch 1
- affected FW23
WAGO · Touch Panel 600 Advanced Line (762-5xxx)
- affected FW16 – < FW22
- unaffected FW22 Patch 1
- affected FW23
WAGO · Touch Panel 600 Marine Line (762-6xxx)
- affected FW16 – < FW22
- unaffected FW22 Patch 1
- affected FW23
WAGO · Touch Panel 600 Standard Line (762-4xxx)
- affected FW16 – < FW22
- unaffected FW22 Patch 1
- affected FW23
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-45140)Record last updated .