CVE-2022-3738: WAGO: Missing authentication for config export functionality in multiple products
The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like credentials and cryptographic material. A valid user has to create a backup after the last reboot for this attack to be successfull.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-3738.
What is the severity of CVE-2022-3738?
The severity of CVE-2022-3738 is medium with a CVSS score of 5.9.
Who is affected by CVE-2022-3738?
The vulnerability affects WAGO PFC100 Firmware (versions 16 to 22), WAGO PFC200 Firmware (versions 16 to 22), Wago Touch Panel 600 Advanced Firmware (versions 16 to 22), Wago Touch Panel 600 Standard Firmware (versions 16 to 22), Wago Touch Panel 600 Marine Firmware (versions 16 to 22), WAGO CC100 Firmware (versions 16 to 22), and WAGO Edge Controller Firmware (versions 16 to 22).
What can an attacker do with CVE-2022-3738?
An unauthenticated attacker can download a backup file containing sensitive information such as credentials and cryptographic material if one exists.
How can I protect myself from CVE-2022-3738?
To protect yourself from CVE-2022-3738, ensure that you do not create a backup file after the last reboot.