Vulnerability-Lookup

CVE-2022-45139 (GCVE-0-2022-45139)

Vulnerability from cvelistv5 – Published: 2023-02-27 14:36 – Updated: 2025-03-10 17:46

Title

WAGO: Origin validation error through CORS misconfiguration

Summary

A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of information readable the impact only affects a small subset of confidentiality.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-03-10 17:45 UTC

CWE

CWE-346 - Origin Validation Error

Assigner

CERTVDE icscert root

References

1 reference

URL	Tags
https://cert.vde.com/en/advisories/VDE-2022-060/

Impacted products

7 products

Vendor	Product	Version
WAGO	Compact Controller CC100 (751-9301)	Affected: FW16 , < FW22 (custom) Unaffected: FW22 Patch 1 Affected: FW23
WAGO	Edge Controller (752-8303/8000-002)	Affected: FW18 , < FW22 (custom) Unaffected: FW22 Patch 1 Affected: FW23
WAGO	PFC100 (750-81xx/xxx-xxx)	Affected: FW16 , < FW22 (custom) Unaffected: FW22 Patch 1 Affected: FW23
WAGO	PFC200 (750-82xx/xxx-xxx)	Affected: FW16 , < FW22 (custom) Unaffected: FW22 Patch 1 Affected: FW23
WAGO	Touch Panel 600 Advanced Line (762-5xxx)	Affected: FW16 , < FW22 (custom) Unaffected: FW22 Patch 1 Affected: FW23
WAGO	Touch Panel 600 Marine Line (762-6xxx)	Affected: FW16 , < FW22 (custom) Unaffected: FW22 Patch 1 Affected: FW23
WAGO	Touch Panel 600 Standard Line (762-4xxx)	Affected: FW16 , < FW22 (custom) Unaffected: FW22 Patch 1 Affected: FW23

Credits

Ryan Pickren of Georgia Institute of Technologys Cyber-Physical Security Lab

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T14:09:55.406Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert.vde.com/en/advisories/VDE-2022-060/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-45139",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-10T17:45:54.261351Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-10T17:46:16.888Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Compact Controller CC100 (751-9301)",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "FW22",
              "status": "affected",
              "version": "FW16",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "FW22 Patch 1"
            },
            {
              "status": "affected",
              "version": "FW23"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Edge Controller (752-8303/8000-002)",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "FW22",
              "status": "affected",
              "version": "FW18",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "FW22 Patch 1"
            },
            {
              "status": "affected",
              "version": "FW23"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PFC100 (750-81xx/xxx-xxx)",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "FW22",
              "status": "affected",
              "version": "FW16",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "FW22 Patch 1"
            },
            {
              "status": "affected",
              "version": "FW23"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PFC200 (750-82xx/xxx-xxx)",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "FW22",
              "status": "affected",
              "version": "FW16",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "FW22 Patch 1"
            },
            {
              "status": "affected",
              "version": "FW23"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Touch Panel 600 Advanced Line (762-5xxx)",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "FW22",
              "status": "affected",
              "version": "FW16",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "FW22 Patch 1"
            },
            {
              "status": "affected",
              "version": "FW23"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Touch Panel 600 Marine Line (762-6xxx)",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "FW22",
              "status": "affected",
              "version": "FW16",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "FW22 Patch 1"
            },
            {
              "status": "affected",
              "version": "FW23"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Touch Panel 600 Standard Line (762-4xxx)",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "FW22",
              "status": "affected",
              "version": "FW16",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "FW22 Patch 1"
            },
            {
              "status": "affected",
              "version": "FW23"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Ryan Pickren of Georgia Institute of Technologys Cyber-Physical Security Lab"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of information readable the impact only affects a small subset of confidentiality."
            }
          ],
          "value": "A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of information readable the impact only affects a small subset of confidentiality."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-554",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-554 Functionality Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346 Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-02-27T14:36:32.016Z",
        "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
        "shortName": "CERTVDE"
      },
      "references": [
        {
          "url": "https://cert.vde.com/en/advisories/VDE-2022-060/"
        }
      ],
      "source": {
        "defect": [
          "CERT@VDE#64160"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "WAGO: Origin validation error through CORS misconfiguration",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
    "assignerShortName": "CERTVDE",
    "cveId": "CVE-2022-45139",
    "datePublished": "2023-02-27T14:36:32.016Z",
    "dateReserved": "2022-11-10T09:46:59.080Z",
    "dateUpdated": "2025-03-10T17:46:16.888Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-45139",
      "date": "2026-10-03",
      "epss": "0.00254",
      "percentile": "0.15395"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-03T14:09:55.406Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://cert.vde.com/en/advisories/VDE-2022-060/"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2022-45139",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-03-10T17:45:54.261351Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-03-10T17:46:02.299Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Compact Controller CC100 (751-9301)",
              "vendor": "WAGO",
              "versions": [
                {
                  "lessThan": "FW22",
                  "status": "affected",
                  "version": "FW16",
                  "versionType": "custom"
                },
                {
                  "status": "unaffected",
                  "version": "FW22 Patch 1"
                },
                {
                  "status": "affected",
                  "version": "FW23"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Edge Controller (752-8303/8000-002)",
              "vendor": "WAGO",
              "versions": [
                {
                  "lessThan": "FW22",
                  "status": "affected",
                  "version": "FW18",
                  "versionType": "custom"
                },
                {
                  "status": "unaffected",
                  "version": "FW22 Patch 1"
                },
                {
                  "status": "affected",
                  "version": "FW23"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "PFC100 (750-81xx/xxx-xxx)",
              "vendor": "WAGO",
              "versions": [
                {
                  "lessThan": "FW22",
                  "status": "affected",
                  "version": "FW16",
                  "versionType": "custom"
                },
                {
                  "status": "unaffected",
                  "version": "FW22 Patch 1"
                },
                {
                  "status": "affected",
                  "version": "FW23"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "PFC200 (750-82xx/xxx-xxx)",
              "vendor": "WAGO",
              "versions": [
                {
                  "lessThan": "FW22",
                  "status": "affected",
                  "version": "FW16",
                  "versionType": "custom"
                },
                {
                  "status": "unaffected",
                  "version": "FW22 Patch 1"
                },
                {
                  "status": "affected",
                  "version": "FW23"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Touch Panel 600 Advanced Line (762-5xxx)",
              "vendor": "WAGO",
              "versions": [
                {
                  "lessThan": "FW22",
                  "status": "affected",
                  "version": "FW16",
                  "versionType": "custom"
                },
                {
                  "status": "unaffected",
                  "version": "FW22 Patch 1"
                },
                {
                  "status": "affected",
                  "version": "FW23"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Touch Panel 600 Marine Line (762-6xxx)",
              "vendor": "WAGO",
              "versions": [
                {
                  "lessThan": "FW22",
                  "status": "affected",
                  "version": "FW16",
                  "versionType": "custom"
                },
                {
                  "status": "unaffected",
                  "version": "FW22 Patch 1"
                },
                {
                  "status": "affected",
                  "version": "FW23"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Touch Panel 600 Standard Line (762-4xxx)",
              "vendor": "WAGO",
              "versions": [
                {
                  "lessThan": "FW22",
                  "status": "affected",
                  "version": "FW16",
                  "versionType": "custom"
                },
                {
                  "status": "unaffected",
                  "version": "FW22 Patch 1"
                },
                {
                  "status": "affected",
                  "version": "FW23"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "user": "00000000-0000-4000-9000-000000000000",
              "value": "Ryan Pickren of Georgia Institute of Technologys Cyber-Physical Security Lab"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of information readable the impact only affects a small subset of confidentiality."
                }
              ],
              "value": "A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of information readable the impact only affects a small subset of confidentiality."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-554",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-554 Functionality Bypass"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-346",
                  "description": "CWE-346 Origin Validation Error",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2023-02-27T14:36:32.016Z",
            "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
            "shortName": "CERTVDE"
          },
          "references": [
            {
              "url": "https://cert.vde.com/en/advisories/VDE-2022-060/"
            }
          ],
          "source": {
            "defect": [
              "CERT@VDE#64160"
            ],
            "discovery": "UNKNOWN"
          },
          "title": "WAGO: Origin validation error through CORS misconfiguration",
          "x_generator": {
            "engine": "Vulnogram 0.1.0-dev"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
        "assignerShortName": "CERTVDE",
        "cveId": "CVE-2022-45139",
        "datePublished": "2023-02-27T14:36:32.016Z",
        "dateReserved": "2022-11-10T09:46:59.080Z",
        "dateUpdated": "2025-03-10T17:46:16.888Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2022-45139

Vulnerability from fkie_nvd - Published: 2023-02-27 15:15 - Updated: 2026-06-17 05:09

Severity

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	info@cert.vde.com	https://cert.vde.com/en/advisories/VDE-2022-060/	Third Party Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://cert.vde.com/en/advisories/VDE-2022-060/	Third Party Advisory

Impacted products

Vendor	Product	Version
wago	751-9301_firmware	*
wago	751-9301_firmware	22
wago	751-9301_firmware	23
wago	751-9301	-
wago	752-8303\/8000-002_firmware	*
wago	752-8303\/8000-002_firmware	22
wago	752-8303\/8000-002_firmware	23
wago	752-8303\/8000-002	-
wago	pfc100_firmware	*
wago	pfc100_firmware	22
wago	pfc100_firmware	23
wago	pfc100	-
wago	pfc200_firmware	*
wago	pfc200_firmware	22
wago	pfc200_firmware	23
wago	pfc200	-
wago	touch_panel_600_advanced_firmware	*
wago	touch_panel_600_advanced_firmware	22
wago	touch_panel_600_advanced_firmware	23
wago	touch_panel_600_advanced	-
wago	touch_panel_600_marine_firmware	*
wago	touch_panel_600_marine_firmware	22
wago	touch_panel_600_marine_firmware	23
wago	touch_panel_600_marine	-
wago	touch_panel_600_standard_firmware	*
wago	touch_panel_600_standard_firmware	22
wago	touch_panel_600_standard_firmware	23
wago	touch_panel_600_standard	-

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Compact Controller CC100 (751-9301)",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "FW22",
              "status": "affected",
              "version": "FW16",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "FW22 Patch 1"
            },
            {
              "status": "affected",
              "version": "FW23"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Edge Controller (752-8303/8000-002)",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "FW22",
              "status": "affected",
              "version": "FW18",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "FW22 Patch 1"
            },
            {
              "status": "affected",
              "version": "FW23"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PFC100 (750-81xx/xxx-xxx)",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "FW22",
              "status": "affected",
              "version": "FW16",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "FW22 Patch 1"
            },
            {
              "status": "affected",
              "version": "FW23"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PFC200 (750-82xx/xxx-xxx)",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "FW22",
              "status": "affected",
              "version": "FW16",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "FW22 Patch 1"
            },
            {
              "status": "affected",
              "version": "FW23"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Touch Panel 600 Advanced Line (762-5xxx)",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "FW22",
              "status": "affected",
              "version": "FW16",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "FW22 Patch 1"
            },
            {
              "status": "affected",
              "version": "FW23"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Touch Panel 600 Marine Line (762-6xxx)",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "FW22",
              "status": "affected",
              "version": "FW16",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "FW22 Patch 1"
            },
            {
              "status": "affected",
              "version": "FW23"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Touch Panel 600 Standard Line (762-4xxx)",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "FW22",
              "status": "affected",
              "version": "FW16",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "FW22 Patch 1"
            },
            {
              "status": "affected",
              "version": "FW23"
            }
          ]
        }
      ],
      "source": "info@cert.vde.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:wago:751-9301_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D694685C-2D87-4C94-9957-6B921E8836CF",
              "versionEndExcluding": "22",
              "versionStartIncluding": "16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:wago:751-9301_firmware:22:-:*:*:*:*:*:*",
              "matchCriteriaId": "E42B14D3-F36A-4213-8447-870E9FC60F48",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:wago:751-9301_firmware:23:*:*:*:*:*:*:*",
              "matchCriteriaId": "84839593-47AD-47C1-8762-FAF10070BCAD",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:wago:751-9301:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "385FE0DA-6383-4EF7-835A-055EB0D22EB8",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:wago:752-8303\\/8000-002_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4958E9ED-6410-4F34-B582-7532A7F3101C",
              "versionEndExcluding": "22",
              "versionStartIncluding": "18",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:wago:752-8303\\/8000-002_firmware:22:-:*:*:*:*:*:*",
              "matchCriteriaId": "C4761AA7-B270-485C-B929-34384145DCBB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:wago:752-8303\\/8000-002_firmware:23:*:*:*:*:*:*:*",
              "matchCriteriaId": "4B514966-03EE-4710-89C0-E8FE771E79CD",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:wago:752-8303\\/8000-002:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "915B0745-EB00-40AD-80BA-887EFB435901",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:wago:pfc100_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D0044A0A-90FD-4C5E-B1F9-A7A0B9EF0BE8",
              "versionEndExcluding": "22",
              "versionStartIncluding": "16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:wago:pfc100_firmware:22:-:*:*:*:*:*:*",
              "matchCriteriaId": "4815DFF8-0CAE-4C85-9F5B-F64C12F43AB0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:wago:pfc100_firmware:23:*:*:*:*:*:*:*",
              "matchCriteriaId": "2C84D09E-A681-47F1-AC37-850BF6E47D01",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:wago:pfc100:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8F636354-95A2-4B36-9666-1FA57F185432",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:wago:pfc200_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EEF2D886-205E-46D2-80DA-2E594F867EE5",
              "versionEndExcluding": "22",
              "versionStartIncluding": "16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:wago:pfc200_firmware:22:-:*:*:*:*:*:*",
              "matchCriteriaId": "B876DC19-0523-41DB-8BD7-1ECC09FCFA01",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:wago:pfc200_firmware:23:*:*:*:*:*:*:*",
              "matchCriteriaId": "BE108CD0-B451-4ED5-83A1-CCEAACC1B40C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:wago:pfc200:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "688A3248-7EAA-499D-A47C-A4D4900CDBD1",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:wago:touch_panel_600_advanced_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FE5248EE-90DF-446C-BC44-D5AF5EDB45A1",
              "versionEndExcluding": "22",
              "versionStartIncluding": "16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:wago:touch_panel_600_advanced_firmware:22:-:*:*:*:*:*:*",
              "matchCriteriaId": "9A613D7C-29C0-4D4E-ACDA-15BBC6FF0104",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:wago:touch_panel_600_advanced_firmware:23:*:*:*:*:*:*:*",
              "matchCriteriaId": "1D06AC6E-2EB2-4ACB-A6CA-E7AB88540713",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:wago:touch_panel_600_advanced:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A8221861-7455-41D5-B310-6AEA822B46CF",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:wago:touch_panel_600_marine_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0FF35303-B999-40FE-8DC1-C18243F13FE7",
              "versionEndExcluding": "22",
              "versionStartIncluding": "16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:wago:touch_panel_600_marine_firmware:22:-:*:*:*:*:*:*",
              "matchCriteriaId": "774CFF47-61B6-48F8-8E1F-E3DC215066AF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:wago:touch_panel_600_marine_firmware:23:*:*:*:*:*:*:*",
              "matchCriteriaId": "CD092B48-C42A-409E-AC9C-F523AD654C1B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:wago:touch_panel_600_marine:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "83DEFFBC-934D-43BE-92AE-25F8EE8C1E0A",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:wago:touch_panel_600_standard_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9B8C054D-F02F-48A0-85D0-DFF90E9C31BB",
              "versionEndExcluding": "22",
              "versionStartIncluding": "16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:wago:touch_panel_600_standard_firmware:22:-:*:*:*:*:*:*",
              "matchCriteriaId": "FA7A911A-395A-4536-8756-83DB2F62899D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:wago:touch_panel_600_standard_firmware:23:*:*:*:*:*:*:*",
              "matchCriteriaId": "263C0C64-F5B4-43C3-BF26-AF24DFA74699",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:wago:touch_panel_600_standard:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E6D7A44C-2D95-4F69-A7DB-435B0A6F9F03",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of information readable the impact only affects a small subset of confidentiality."
    }
  ],
  "id": "CVE-2022-45139",
  "lastModified": "2026-06-17T05:09:26.477",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "info@cert.vde.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-45139",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-03-10T17:45:54.261351Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2023-02-27T15:15:11.407",
  "references": [
    {
      "source": "info@cert.vde.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://cert.vde.com/en/advisories/VDE-2022-060/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://cert.vde.com/en/advisories/VDE-2022-060/"
    }
  ],
  "sourceIdentifier": "info@cert.vde.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        }
      ],
      "source": "info@cert.vde.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-P586-5MQW-6F9X

Vulnerability from github – Published: 2023-02-27 15:30 – Updated: 2023-02-27 15:30

Details

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-45139"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-346"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-02-27T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of information readable the impact only affects a small subset of confidentiality.",
  "id": "GHSA-p586-5mqw-6f9x",
  "modified": "2023-02-27T15:30:20Z",
  "published": "2023-02-27T15:30:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45139"
    },
    {
      "type": "WEB",
      "url": "https://cert.vde.com/en/advisories/VDE-2022-060"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2022-45139

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

Aliases

CVE-2022-45139

Aliases

CVE-2022-45139

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2022-45139",
    "description": "A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of information readable the impact only affects a small subset of confidentiality.",
    "id": "GSD-2022-45139"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-45139"
      ],
      "details": "A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of information readable the impact only affects a small subset of confidentiality.",
      "id": "GSD-2022-45139",
      "modified": "2023-12-13T01:19:24.532429Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "info@cert.vde.com",
        "ID": "CVE-2022-45139",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Compact Controller CC100 (751-9301)",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "unaffected",
                            "versions": [
                              {
                                "lessThan": "FW22",
                                "status": "affected",
                                "version": "FW16",
                                "versionType": "custom"
                              },
                              {
                                "status": "unaffected",
                                "version": "FW22 Patch 1"
                              },
                              {
                                "status": "affected",
                                "version": "FW23"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Edge Controller (752-8303/8000-002)",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "unaffected",
                            "versions": [
                              {
                                "lessThan": "FW22",
                                "status": "affected",
                                "version": "FW18",
                                "versionType": "custom"
                              },
                              {
                                "status": "unaffected",
                                "version": "FW22 Patch 1"
                              },
                              {
                                "status": "affected",
                                "version": "FW23"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "PFC100 (750-81xx/xxx-xxx)",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "unaffected",
                            "versions": [
                              {
                                "lessThan": "FW22",
                                "status": "affected",
                                "version": "FW16",
                                "versionType": "custom"
                              },
                              {
                                "status": "unaffected",
                                "version": "FW22 Patch 1"
                              },
                              {
                                "status": "affected",
                                "version": "FW23"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "PFC200 (750-82xx/xxx-xxx)",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "unaffected",
                            "versions": [
                              {
                                "lessThan": "FW22",
                                "status": "affected",
                                "version": "FW16",
                                "versionType": "custom"
                              },
                              {
                                "status": "unaffected",
                                "version": "FW22 Patch 1"
                              },
                              {
                                "status": "affected",
                                "version": "FW23"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Touch Panel 600 Advanced Line (762-5xxx)",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "unaffected",
                            "versions": [
                              {
                                "lessThan": "FW22",
                                "status": "affected",
                                "version": "FW16",
                                "versionType": "custom"
                              },
                              {
                                "status": "unaffected",
                                "version": "FW22 Patch 1"
                              },
                              {
                                "status": "affected",
                                "version": "FW23"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Touch Panel 600 Marine Line (762-6xxx)",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "unaffected",
                            "versions": [
                              {
                                "lessThan": "FW22",
                                "status": "affected",
                                "version": "FW16",
                                "versionType": "custom"
                              },
                              {
                                "status": "unaffected",
                                "version": "FW22 Patch 1"
                              },
                              {
                                "status": "affected",
                                "version": "FW23"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Touch Panel 600 Standard Line (762-4xxx)",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "unaffected",
                            "versions": [
                              {
                                "lessThan": "FW22",
                                "status": "affected",
                                "version": "FW16",
                                "versionType": "custom"
                              },
                              {
                                "status": "unaffected",
                                "version": "FW22 Patch 1"
                              },
                              {
                                "status": "affected",
                                "version": "FW23"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "WAGO"
            }
          ]
        }
      },
      "credits": [
        {
          "lang": "en",
          "value": "Ryan Pickren of Georgia Institute of Technologys Cyber-Physical Security Lab"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of information readable the impact only affects a small subset of confidentiality."
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.1.0-dev"
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-346",
                "lang": "eng",
                "value": "CWE-346 Origin Validation Error"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://cert.vde.com/en/advisories/VDE-2022-060/",
            "refsource": "MISC",
            "url": "https://cert.vde.com/en/advisories/VDE-2022-060/"
          }
        ]
      },
      "source": {
        "defect": [
          "CERT@VDE#64160"
        ],
        "discovery": "UNKNOWN"
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:wago:751-9301_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "22",
                    "versionStartIncluding": "16",
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:wago:751-9301_firmware:22:-:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:wago:751-9301_firmware:23:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:wago:751-9301:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:wago:752-8303\\/8000-002_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "22",
                    "versionStartIncluding": "18",
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:wago:752-8303\\/8000-002_firmware:22:-:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:wago:752-8303\\/8000-002_firmware:23:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:wago:752-8303\\/8000-002:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:wago:pfc100_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "22",
                    "versionStartIncluding": "16",
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:wago:pfc100_firmware:22:-:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:wago:pfc100_firmware:23:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:wago:pfc100:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:wago:pfc200_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "22",
                    "versionStartIncluding": "16",
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:wago:pfc200_firmware:22:-:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:wago:pfc200_firmware:23:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:wago:pfc200:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:wago:touch_panel_600_advanced_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "22",
                    "versionStartIncluding": "16",
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:wago:touch_panel_600_advanced_firmware:22:-:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:wago:touch_panel_600_advanced_firmware:23:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:wago:touch_panel_600_advanced:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:wago:touch_panel_600_marine_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "22",
                    "versionStartIncluding": "16",
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:wago:touch_panel_600_marine_firmware:22:-:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:wago:touch_panel_600_marine_firmware:23:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:wago:touch_panel_600_marine:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:wago:touch_panel_600_standard_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "22",
                    "versionStartIncluding": "16",
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:wago:touch_panel_600_standard_firmware:22:-:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:wago:touch_panel_600_standard_firmware:23:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:wago:touch_panel_600_standard:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "info@cert.vde.com",
          "ID": "CVE-2022-45139"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of information readable the impact only affects a small subset of confidentiality."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-346"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://cert.vde.com/en/advisories/VDE-2022-060/",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://cert.vde.com/en/advisories/VDE-2022-060/"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 1.4
        }
      },
      "lastModifiedDate": "2023-03-07T22:54Z",
      "publishedDate": "2023-02-27T15:15Z"
    }
  }
}

VDE-2022-060

Vulnerability from csaf_wagogmbhcokg - Published: 2023-02-27 11:00 - Updated: 2023-02-27 11:00

Summary

WAGO: Multiple vulnerabilities in web-based management of multiple products

Scope

4 vulnerabilities in this advisory, including CVE-2022-45139.

CVE-2022-45139

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Fixed: 14 products Known affected: 14 products

Open the full advisory

VDE-2024-054

Vulnerability from csaf_endresshauserag - Published: 2024-10-21 08:00 - Updated: 2025-05-22 13:03

Summary

Endress+Hauser: Netilion Network Insights is affected by multiple vulnerabilities

Scope

5 vulnerabilities in this advisory, including CVE-2022-45139.

CVE-2022-45139

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Fixed: 2 products Known affected: 4 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2022-45139 (GCVE-0-2022-45139)

FKIE_CVE-2022-45139

GHSA-P586-5MQW-6F9X

GSD-2022-45139

VDE-2022-060

VDE-2024-054

Tags

Sightings

Nomenclature

Related by attack behaviour