GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-45139 (GCVE-0-2022-45139)

Vulnerability from cvelistv5 – Published: 2023-02-27 14:36 – Updated: 2025-03-10 17:46
VLAI
Title
WAGO: Origin validation error through CORS misconfiguration
Summary
A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of information readable the impact only affects a small subset of confidentiality.
Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-10 17:45 UTC
CWE
  • CWE-346 - Origin Validation Error
Assigner
References
Impacted products
Vendor Product Version CPE status
WAGO Compact Controller CC100 (751-9301) Affected: FW16 , < FW22 (custom)
Unaffected: FW22 Patch 1
Affected: FW23
guessed Create a notification for this product.
WAGO Edge Controller (752-8303/8000-002) Affected: FW18 , < FW22 (custom)
Unaffected: FW22 Patch 1
Affected: FW23
guessed Create a notification for this product.
WAGO PFC100 (750-81xx/xxx-xxx) Affected: FW16 , < FW22 (custom)
Unaffected: FW22 Patch 1
Affected: FW23
guessed Create a notification for this product.
WAGO PFC200 (750-82xx/xxx-xxx) Affected: FW16 , < FW22 (custom)
Unaffected: FW22 Patch 1
Affected: FW23
guessed Create a notification for this product.
WAGO Touch Panel 600 Advanced Line (762-5xxx) Affected: FW16 , < FW22 (custom)
Unaffected: FW22 Patch 1
Affected: FW23
guessed Create a notification for this product.
WAGO Touch Panel 600 Marine Line (762-6xxx) Affected: FW16 , < FW22 (custom)
Unaffected: FW22 Patch 1
Affected: FW23
guessed Create a notification for this product.
WAGO Touch Panel 600 Standard Line (762-4xxx) Affected: FW16 , < FW22 (custom)
Unaffected: FW22 Patch 1
Affected: FW23
guessed Create a notification for this product.
Credits
Ryan Pickren of Georgia Institute of Technologys Cyber-Physical Security Lab
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T14:09:55.406Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert.vde.com/en/advisories/VDE-2022-060/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-45139",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-10T17:45:54.261351Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-10T17:46:16.888Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Compact Controller CC100 (751-9301)",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "FW22",
              "status": "affected",
              "version": "FW16",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "FW22 Patch 1"
            },
            {
              "status": "affected",
              "version": "FW23"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Edge Controller (752-8303/8000-002)",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "FW22",
              "status": "affected",
              "version": "FW18",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "FW22 Patch 1"
            },
            {
              "status": "affected",
              "version": "FW23"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PFC100 (750-81xx/xxx-xxx)",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "FW22",
              "status": "affected",
              "version": "FW16",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "FW22 Patch 1"
            },
            {
              "status": "affected",
              "version": "FW23"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PFC200 (750-82xx/xxx-xxx)",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "FW22",
              "status": "affected",
              "version": "FW16",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "FW22 Patch 1"
            },
            {
              "status": "affected",
              "version": "FW23"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Touch Panel 600 Advanced Line (762-5xxx)",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "FW22",
              "status": "affected",
              "version": "FW16",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "FW22 Patch 1"
            },
            {
              "status": "affected",
              "version": "FW23"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Touch Panel 600 Marine Line (762-6xxx)",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "FW22",
              "status": "affected",
              "version": "FW16",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "FW22 Patch 1"
            },
            {
              "status": "affected",
              "version": "FW23"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Touch Panel 600 Standard Line (762-4xxx)",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "FW22",
              "status": "affected",
              "version": "FW16",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "FW22 Patch 1"
            },
            {
              "status": "affected",
              "version": "FW23"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Ryan Pickren of Georgia Institute of Technologys Cyber-Physical Security Lab"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of information readable the impact only affects a small subset of confidentiality."
            }
          ],
          "value": "A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of information readable the impact only affects a small subset of confidentiality."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-554",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-554 Functionality Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346 Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-02-27T14:36:32.016Z",
        "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
        "shortName": "CERTVDE"
      },
      "references": [
        {
          "url": "https://cert.vde.com/en/advisories/VDE-2022-060/"
        }
      ],
      "source": {
        "defect": [
          "CERT@VDE#64160"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "WAGO: Origin validation error through CORS misconfiguration",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
    "assignerShortName": "CERTVDE",
    "cveId": "CVE-2022-45139",
    "datePublished": "2023-02-27T14:36:32.016Z",
    "dateReserved": "2022-11-10T09:46:59.080Z",
    "dateUpdated": "2025-03-10T17:46:16.888Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-45139",
      "date": "2026-09-16",
      "epss": "0.00254",
      "percentile": "0.1713"
    },
    "fkie_nvd": {
      "configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:wago:751-9301_firmware:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"16\", \"versionEndExcluding\": \"22\", \"matchCriteriaId\": \"D694685C-2D87-4C94-9957-6B921E8836CF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:wago:751-9301_firmware:22:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"E42B14D3-F36A-4213-8447-870E9FC60F48\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:wago:751-9301_firmware:23:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"84839593-47AD-47C1-8762-FAF10070BCAD\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:wago:751-9301:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"385FE0DA-6383-4EF7-835A-055EB0D22EB8\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:wago:752-8303\\\\/8000-002_firmware:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"18\", \"versionEndExcluding\": \"22\", \"matchCriteriaId\": \"4958E9ED-6410-4F34-B582-7532A7F3101C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:wago:752-8303\\\\/8000-002_firmware:22:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"C4761AA7-B270-485C-B929-34384145DCBB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:wago:752-8303\\\\/8000-002_firmware:23:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4B514966-03EE-4710-89C0-E8FE771E79CD\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:wago:752-8303\\\\/8000-002:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"915B0745-EB00-40AD-80BA-887EFB435901\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:wago:pfc100_firmware:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"16\", \"versionEndExcluding\": \"22\", \"matchCriteriaId\": \"D0044A0A-90FD-4C5E-B1F9-A7A0B9EF0BE8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:wago:pfc100_firmware:22:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"4815DFF8-0CAE-4C85-9F5B-F64C12F43AB0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:wago:pfc100_firmware:23:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2C84D09E-A681-47F1-AC37-850BF6E47D01\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:wago:pfc100:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8F636354-95A2-4B36-9666-1FA57F185432\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:wago:pfc200_firmware:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"16\", \"versionEndExcluding\": \"22\", \"matchCriteriaId\": \"EEF2D886-205E-46D2-80DA-2E594F867EE5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:wago:pfc200_firmware:22:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"B876DC19-0523-41DB-8BD7-1ECC09FCFA01\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:wago:pfc200_firmware:23:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BE108CD0-B451-4ED5-83A1-CCEAACC1B40C\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:wago:pfc200:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"688A3248-7EAA-499D-A47C-A4D4900CDBD1\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:wago:touch_panel_600_advanced_firmware:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"16\", \"versionEndExcluding\": \"22\", \"matchCriteriaId\": \"FE5248EE-90DF-446C-BC44-D5AF5EDB45A1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:wago:touch_panel_600_advanced_firmware:22:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"9A613D7C-29C0-4D4E-ACDA-15BBC6FF0104\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:wago:touch_panel_600_advanced_firmware:23:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1D06AC6E-2EB2-4ACB-A6CA-E7AB88540713\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:wago:touch_panel_600_advanced:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A8221861-7455-41D5-B310-6AEA822B46CF\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:wago:touch_panel_600_marine_firmware:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"16\", \"versionEndExcluding\": \"22\", \"matchCriteriaId\": \"0FF35303-B999-40FE-8DC1-C18243F13FE7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:wago:touch_panel_600_marine_firmware:22:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"774CFF47-61B6-48F8-8E1F-E3DC215066AF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:wago:touch_panel_600_marine_firmware:23:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CD092B48-C42A-409E-AC9C-F523AD654C1B\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:wago:touch_panel_600_marine:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"83DEFFBC-934D-43BE-92AE-25F8EE8C1E0A\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:wago:touch_panel_600_standard_firmware:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"16\", \"versionEndExcluding\": \"22\", \"matchCriteriaId\": \"9B8C054D-F02F-48A0-85D0-DFF90E9C31BB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:wago:touch_panel_600_standard_firmware:22:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"FA7A911A-395A-4536-8756-83DB2F62899D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:wago:touch_panel_600_standard_firmware:23:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"263C0C64-F5B4-43C3-BF26-AF24DFA74699\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:wago:touch_panel_600_standard:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E6D7A44C-2D95-4F69-A7DB-435B0A6F9F03\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of information readable the impact only affects a small subset of confidentiality.\"}]",
      "id": "CVE-2022-45139",
      "lastModified": "2024-11-21T07:28:50.013",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"info@cert.vde.com\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 1.4}]}",
      "published": "2023-02-27T15:15:11.407",
      "references": "[{\"url\": \"https://cert.vde.com/en/advisories/VDE-2022-060/\", \"source\": \"info@cert.vde.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://cert.vde.com/en/advisories/VDE-2022-060/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
      "sourceIdentifier": "info@cert.vde.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"info@cert.vde.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-346\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-346\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-45139\",\"sourceIdentifier\":\"info@cert.vde.com\",\"published\":\"2023-02-27T15:15:11.407\",\"lastModified\":\"2026-06-17T05:09:26.477\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of information readable the impact only affects a small subset of confidentiality.\"}],\"affected\":[{\"source\":\"info@cert.vde.com\",\"affectedData\":[{\"vendor\":\"WAGO\",\"product\":\"Compact Controller CC100 (751-9301)\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"FW16\",\"lessThan\":\"FW22\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"FW22 Patch 1\",\"status\":\"unaffected\"},{\"version\":\"FW23\",\"status\":\"affected\"}]},{\"vendor\":\"WAGO\",\"product\":\"Edge Controller (752-8303/8000-002)\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"FW18\",\"lessThan\":\"FW22\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"FW22 Patch 1\",\"status\":\"unaffected\"},{\"version\":\"FW23\",\"status\":\"affected\"}]},{\"vendor\":\"WAGO\",\"product\":\"PFC100 (750-81xx/xxx-xxx)\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"FW16\",\"lessThan\":\"FW22\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"FW22 Patch 1\",\"status\":\"unaffected\"},{\"version\":\"FW23\",\"status\":\"affected\"}]},{\"vendor\":\"WAGO\",\"product\":\"PFC200 (750-82xx/xxx-xxx)\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"FW16\",\"lessThan\":\"FW22\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"FW22 Patch 1\",\"status\":\"unaffected\"},{\"version\":\"FW23\",\"status\":\"affected\"}]},{\"vendor\":\"WAGO\",\"product\":\"Touch Panel 600 Advanced Line (762-5xxx)\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"FW16\",\"lessThan\":\"FW22\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"FW22 Patch 1\",\"status\":\"unaffected\"},{\"version\":\"FW23\",\"status\":\"affected\"}]},{\"vendor\":\"WAGO\",\"product\":\"Touch Panel 600 Marine Line (762-6xxx)\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"FW16\",\"lessThan\":\"FW22\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"FW22 Patch 1\",\"status\":\"unaffected\"},{\"version\":\"FW23\",\"status\":\"affected\"}]},{\"vendor\":\"WAGO\",\"product\":\"Touch Panel 600 Standard Line (762-4xxx)\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"FW16\",\"lessThan\":\"FW22\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"FW22 Patch 1\",\"status\":\"unaffected\"},{\"version\":\"FW23\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"info@cert.vde.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-03-10T17:45:54.261351Z\",\"id\":\"CVE-2022-45139\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"info@cert.vde.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-346\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-346\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:wago:751-9301_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"16\",\"versionEndExcluding\":\"22\",\"matchCriteriaId\":\"D694685C-2D87-4C94-9957-6B921E8836CF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:wago:751-9301_firmware:22:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"E42B14D3-F36A-4213-8447-870E9FC60F48\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:wago:751-9301_firmware:23:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"84839593-47AD-47C1-8762-FAF10070BCAD\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:wago:751-9301:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"385FE0DA-6383-4EF7-835A-055EB0D22EB8\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:wago:752-8303\\\\/8000-002_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"18\",\"versionEndExcluding\":\"22\",\"matchCriteriaId\":\"4958E9ED-6410-4F34-B582-7532A7F3101C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:wago:752-8303\\\\/8000-002_firmware:22:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"C4761AA7-B270-485C-B929-34384145DCBB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:wago:752-8303\\\\/8000-002_firmware:23:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4B514966-03EE-4710-89C0-E8FE771E79CD\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:wago:752-8303\\\\/8000-002:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"915B0745-EB00-40AD-80BA-887EFB435901\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:wago:pfc100_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"16\",\"versionEndExcluding\":\"22\",\"matchCriteriaId\":\"D0044A0A-90FD-4C5E-B1F9-A7A0B9EF0BE8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:wago:pfc100_firmware:22:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"4815DFF8-0CAE-4C85-9F5B-F64C12F43AB0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:wago:pfc100_firmware:23:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2C84D09E-A681-47F1-AC37-850BF6E47D01\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:wago:pfc100:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8F636354-95A2-4B36-9666-1FA57F185432\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:wago:pfc200_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"16\",\"versionEndExcluding\":\"22\",\"matchCriteriaId\":\"EEF2D886-205E-46D2-80DA-2E594F867EE5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:wago:pfc200_firmware:22:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"B876DC19-0523-41DB-8BD7-1ECC09FCFA01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:wago:pfc200_firmware:23:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BE108CD0-B451-4ED5-83A1-CCEAACC1B40C\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:wago:pfc200:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"688A3248-7EAA-499D-A47C-A4D4900CDBD1\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:wago:touch_panel_600_advanced_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"16\",\"versionEndExcluding\":\"22\",\"matchCriteriaId\":\"FE5248EE-90DF-446C-BC44-D5AF5EDB45A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:wago:touch_panel_600_advanced_firmware:22:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"9A613D7C-29C0-4D4E-ACDA-15BBC6FF0104\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:wago:touch_panel_600_advanced_firmware:23:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D06AC6E-2EB2-4ACB-A6CA-E7AB88540713\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:wago:touch_panel_600_advanced:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A8221861-7455-41D5-B310-6AEA822B46CF\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:wago:touch_panel_600_marine_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"16\",\"versionEndExcluding\":\"22\",\"matchCriteriaId\":\"0FF35303-B999-40FE-8DC1-C18243F13FE7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:wago:touch_panel_600_marine_firmware:22:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"774CFF47-61B6-48F8-8E1F-E3DC215066AF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:wago:touch_panel_600_marine_firmware:23:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CD092B48-C42A-409E-AC9C-F523AD654C1B\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:wago:touch_panel_600_marine:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"83DEFFBC-934D-43BE-92AE-25F8EE8C1E0A\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:wago:touch_panel_600_standard_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"16\",\"versionEndExcluding\":\"22\",\"matchCriteriaId\":\"9B8C054D-F02F-48A0-85D0-DFF90E9C31BB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:wago:touch_panel_600_standard_firmware:22:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA7A911A-395A-4536-8756-83DB2F62899D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:wago:touch_panel_600_standard_firmware:23:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"263C0C64-F5B4-43C3-BF26-AF24DFA74699\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:wago:touch_panel_600_standard:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E6D7A44C-2D95-4F69-A7DB-435B0A6F9F03\"}]}]}],\"references\":[{\"url\":\"https://cert.vde.com/en/advisories/VDE-2022-060/\",\"source\":\"info@cert.vde.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://cert.vde.com/en/advisories/VDE-2022-060/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2025-05-29T01:19:52+00:00",
      "cve": "CVE-2022-45139",
      "id": "CVE-2022-45139",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "WAGO: Origin validation error through CORS misconfiguration",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-45139.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://cert.vde.com/en/advisories/VDE-2022-060/\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T14:09:55.406Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-45139\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-03-10T17:45:54.261351Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-03-10T17:46:02.299Z\"}}], \"cna\": {\"title\": \"WAGO: Origin validation error through CORS misconfiguration\", \"source\": {\"defect\": [\"CERT@VDE#64160\"], \"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Ryan Pickren of Georgia Institute of Technologys Cyber-Physical Security Lab\"}], \"impacts\": [{\"capecId\": \"CAPEC-554\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-554 Functionality Bypass\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"WAGO\", \"product\": \"Compact Controller CC100 (751-9301)\", \"versions\": [{\"status\": \"affected\", \"version\": \"FW16\", \"lessThan\": \"FW22\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"FW22 Patch 1\"}, {\"status\": \"affected\", \"version\": \"FW23\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WAGO\", \"product\": \"Edge Controller (752-8303/8000-002)\", \"versions\": [{\"status\": \"affected\", \"version\": \"FW18\", \"lessThan\": \"FW22\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"FW22 Patch 1\"}, {\"status\": \"affected\", \"version\": \"FW23\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WAGO\", \"product\": \"PFC100 (750-81xx/xxx-xxx)\", \"versions\": [{\"status\": \"affected\", \"version\": \"FW16\", \"lessThan\": \"FW22\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"FW22 Patch 1\"}, {\"status\": \"affected\", \"version\": \"FW23\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WAGO\", \"product\": \"PFC200 (750-82xx/xxx-xxx)\", \"versions\": [{\"status\": \"affected\", \"version\": \"FW16\", \"lessThan\": \"FW22\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"FW22 Patch 1\"}, {\"status\": \"affected\", \"version\": \"FW23\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WAGO\", \"product\": \"Touch Panel 600 Advanced Line (762-5xxx)\", \"versions\": [{\"status\": \"affected\", \"version\": \"FW16\", \"lessThan\": \"FW22\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"FW22 Patch 1\"}, {\"status\": \"affected\", \"version\": \"FW23\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WAGO\", \"product\": \"Touch Panel 600 Marine Line (762-6xxx)\", \"versions\": [{\"status\": \"affected\", \"version\": \"FW16\", \"lessThan\": \"FW22\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"FW22 Patch 1\"}, {\"status\": \"affected\", \"version\": \"FW23\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WAGO\", \"product\": \"Touch Panel 600 Standard Line (762-4xxx)\", \"versions\": [{\"status\": \"affected\", \"version\": \"FW16\", \"lessThan\": \"FW22\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"FW22 Patch 1\"}, {\"status\": \"affected\", \"version\": \"FW23\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://cert.vde.com/en/advisories/VDE-2022-060/\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of information readable the impact only affects a small subset of confidentiality.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of information readable the impact only affects a small subset of confidentiality.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-346\", \"description\": \"CWE-346 Origin Validation Error\"}]}], \"providerMetadata\": {\"orgId\": \"270ccfa6-a436-4e77-922e-914ec3a9685c\", \"shortName\": \"CERTVDE\", \"dateUpdated\": \"2023-02-27T14:36:32.016Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-45139\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-03-10T17:46:16.888Z\", \"dateReserved\": \"2022-11-10T09:46:59.080Z\", \"assignerOrgId\": \"270ccfa6-a436-4e77-922e-914ec3a9685c\", \"datePublished\": \"2023-02-27T14:36:32.016Z\", \"assignerShortName\": \"CERTVDE\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.