CVE-2022-45138: WAGO: Missing Authentication for Critical Function
The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API. The vulnerability allows an unauthenticated attacker to read and set several device parameters that can lead to full compromise of the device.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-45138?
CVE-2022-45138 is a vulnerability in the configuration backend of the web-based management of WAGO devices.
How can unauthenticated users exploit CVE-2022-45138?
Unauthenticated users can exploit CVE-2022-45138 by accessing the configuration backend and reading/setting device parameters.
What is the severity of CVE-2022-45138?
The severity of CVE-2022-45138 is critical with a CVSS score of 9.8.
Which WAGO devices are affected by CVE-2022-45138?
WAGO devices with firmware versions 16 to 22 are affected by CVE-2022-45138.
Where can I find more information about CVE-2022-45138?
You can find more information about CVE-2022-45138 at the following link: [VDE-2022-060 Advisory](https://cert.vde.com/en/advisories/VDE-2022-060/).