Medium severity · published Feb 27, 2023
CVE-2022-45137
The configuration backend of the web-based management is vulnerable to reflected XSS (Cross-Site Scripting) attacks that targets the users browser
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
The configuration backend of the web-based management is vulnerable to reflected XSS (Cross-Site Scripting) attacks that targets the users browser. This leads to a limited impact of confidentiality and integrity but no impact of availability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
7F
751-9301 Firmware · Wago
16 before 22; 22; 23 · source: NVD
7F
752-8303/8000-002 Firmware · Wago
18 before 22; 22; 23 · source: NVD
PF
Pfc100 Firmware · Wago
16 before 22; 22; 23 · source: NVD
PF
Pfc200 Firmware · Wago
16 before 22; 22; 23 · source: NVD
TP
Touch Panel 600 Advanced Firmware · Wago
16 before 22; 22; 23 · source: NVD
TP
Touch Panel 600 Marine Firmware · Wago
16 before 22; 22; 23 · source: NVD
TP
Touch Panel 600 Standard Firmware · Wago
16 before 22; 22; 23 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-45137
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-45137
Mitigation
https://cert.vde.com/en/advisories/VDE-2022-060/
More from 751-9301 Firmware
9.8
CVE-2022-45140
The configuration backend allows an unauthenticated user to write arbitrary data with root privileges to the storage, which could lead to unauthenticated remote code execution and…
9.8
CVE-2022-45138
The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API
5.4
CVE-2022-22511
Various configuration pages of the device are vulnerable to reflected XSS (Cross-Site Scripting) attacks
5.3
CVE-2022-45139
A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver