PF
Product
Pfc100 Firmware
13
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 3Medium 5Low 1
Watch
Add Pfc100 Firmware to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-1698 | 9.8 | May 15 | In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended… Affected: 20 through 23 |
| CVE-2022-45140 | 9.8 | Feb 27 | The configuration backend allows an unauthenticated user to write arbitrary data with root privileges to the storage, which could lead to unauthenticated remote code execution and… Affected: 16 before 22; 22; 23 |
| CVE-2022-45138 | 9.8 | Feb 27 | The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API Affected: 16 before 22; 22; 23 |
| CVE-2019-5082 | 9.8 | Jan 8 | An exploitable heap buffer overflow vulnerability exists in the iocheckd service I/O-Check functionality of WAGO PFC200 Firmware version 03.01.07(13), WAGO PFC200 Firmware version… Affected: 03.00.39(12) |
| CVE-2019-5149 | 7.5 | Mar 11 | The WBM web application on firmwares prior to 03.02.02 and 03.01.07 on the WAGO PFC100 and PFC2000, respectively, runs on a lighttpd web server and makes use of the FastCGI… Affected: 03.00.39(12); 03.01.07(13) |
| CVE-2019-5134 | 7.5 | Mar 11 | An exploitable regular expression without anchors vulnerability exists in the Web-Based Management (WBM) authentication functionality of WAGO PFC200 versions 03.00.39(12) and… Affected: 03.00.39(12) |
| CVE-2019-10953 | 7.5 | Apr 17 | ABB, Phoenix Contact, Schneider Electric, Siemens, WAGO - Programmable Logic Controllers, multiple versions Affected: All versions, or not specified |
| CVE-2022-45137 | 6.1 | Feb 27 | The configuration backend of the web-based management is vulnerable to reflected XSS (Cross-Site Scripting) attacks that targets the users browser Affected: 16 before 22; 22; 23 |
| CVE-2022-3738 | 5.9 | Jan 19 | The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists Affected: 16 through 22 |
| CVE-2023-3379 | 5.3 | Nov 20 | Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker to change the passwords of other non-admin users and thus to… Affected: before 22; 22; 22 |
| CVE-2022-45139 | 5.3 | Feb 27 | A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver Affected: 16 before 22; 22; 23 |
| CVE-2019-5135 | 5.3 | Mar 11 | An exploitable timing discrepancy vulnerability exists in the authentication functionality of the Web-Based Management (WBM) web application on WAGO PFC100/200 controllers Affected: 03.00.39(12) |
| CVE-2023-4089 | 2.7 | Oct 17 | On affected Wago products an remote attacker with administrative privileges can access files to which he has already access to through an undocumented local file inclusion Affected: 16 through 26 |
Showing 13