VDE-2026-016
Vulnerability from csaf_vegagrieshaberkg - Published: 2026-04-22 09:00 - Updated: 2026-06-24 10:00Summary
VEGA: Unsecured Configuration Interface Allows Unauthorized Access Leading to Privilege Escalation
Severity
High
Notes
Summary: Vulnerable components expose sensitive information to unauthorized actors through an unsecured configuration interface. Vulnerable firmware releases contain an unsecured configuration interface that allows retrieval of sensitive information such as hashed credentials.
It was found that users with no or low rights can access information from devices that should not be available to them.
An attacker can use this information to impersonate authorized users.
Impact: An unauthenticated attacker can obtain sensitive information, potentially enabling authenticated device modification.
Mitigation: Implement access controls for physical interfaces to prevent unauthorized access.
Remediation: Update to the fixed firmware versions listed in this advisory. Rotate any credentials used on affected devices as they may have been compromised. Contact VEGA Support if emergency code rotation is necessary based on your risk assessment.
Fixed Version:
* Firmware 1.1.1 installed on VEGAPULS 6X Two-wire PROFINET, Modbus TCP, OPC UA (Ethernet-APL)
General Recommendation: Implement access controls for physical interfaces to prevent unauthorized access.
An unsecured configuration interface on affected devices allows unauthenticated remote attackers to access sensitive information, including hashed credentials and access codes.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-32001 | — |
References
5 references
Acknowledgments
CERT@VDE
certvde.com
Product Security Unit at VEGA Grieshaber KG
www.vega.com
{
"document": {
"acknowledgments": [
{
"organization": "CERT@VDE",
"summary": "coordination",
"urls": [
"https://certvde.com"
]
},
{
"organization": "Product Security Unit at VEGA Grieshaber KG",
"summary": "reporting",
"urls": [
"https://www.vega.com"
]
}
],
"aggregate_severity": {
"namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale",
"text": "high"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "en-US",
"notes": [
{
"category": "summary",
"text": "Vulnerable components expose sensitive information to unauthorized actors through an unsecured configuration interface. Vulnerable firmware releases contain an unsecured configuration interface that allows retrieval of sensitive information such as hashed credentials.\n\nIt was found that users with no or low rights can access information from devices that should not be available to them.\n\nAn attacker can use this information to impersonate authorized users.",
"title": "Summary"
},
{
"category": "description",
"text": "An unauthenticated attacker can obtain sensitive information, potentially enabling authenticated device modification.",
"title": "Impact"
},
{
"category": "description",
"text": "Implement access controls for physical interfaces to prevent unauthorized access.",
"title": "Mitigation"
},
{
"category": "description",
"text": "Update to the fixed firmware versions listed in this advisory. Rotate any credentials used on affected devices as they may have been compromised. Contact VEGA Support if emergency code rotation is necessary based on your risk assessment.\n\nFixed Version:\n* Firmware 1.1.1 installed on VEGAPULS 6X Two-wire PROFINET, Modbus TCP, OPC UA (Ethernet-APL)",
"title": "Remediation"
},
{
"category": "general",
"text": "Implement access controls for physical interfaces to prevent unauthorized access.",
"title": "General Recommendation"
}
],
"publisher": {
"category": "vendor",
"contact_details": "psirt@vega.com",
"name": "VEGA Grieshaber KG",
"namespace": "https://vega.com"
},
"references": [
{
"category": "external",
"summary": "VEGA Grieshaber PSIRT",
"url": "https://www.vega.com/en-us/company/legal-notice/information-on-cyber-security"
},
{
"category": "external",
"summary": "CERT@VDE Security Advisories for VEGA Grieshaber",
"url": "https://certvde.com/en/advisories/vendor/vega"
},
{
"category": "self",
"summary": "VDE-2026-016: VEGA: Unsecured Configuration Interface Allows Unauthorized Access Leading to Privilege Escalation - HTML",
"url": "https://certvde.com/en/advisories/VDE-2026-016"
},
{
"category": "self",
"summary": "VDE-2026-016: VEGA: Unsecured Configuration Interface Allows Unauthorized Access Leading to Privilege Escalation - CSAF",
"url": "https://vega.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-016.json"
}
],
"title": "VEGA: Unsecured Configuration Interface Allows Unauthorized Access Leading to Privilege Escalation",
"tracking": {
"aliases": [
"VDE-2026-016"
],
"current_release_date": "2026-06-24T10:00:00.000Z",
"generator": {
"date": "2026-06-24T08:37:11.878Z",
"engine": {
"name": "Secvisogram",
"version": "2.5.44"
}
},
"id": "VDE-2026-016",
"initial_release_date": "2026-04-22T09:00:00.000Z",
"revision_history": [
{
"date": "2026-04-22T09:00:00.000Z",
"number": "1.0.0",
"summary": "Initial version"
},
{
"date": "2026-06-24T10:00:00.000Z",
"number": "1.0.1",
"summary": "Added fixed Version to document notes remediation"
}
],
"status": "final",
"version": "1.0.1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "VEGAPULS 6X Two-wire PROFINET, Modbus TCP, OPC UA (Ethernet-APL)",
"product": {
"name": "VEGAPULS 6X Two-wire PROFINET, Modbus TCP, OPC UA (Ethernet-APL)",
"product_id": "CSAFPID-11001",
"product_identification_helper": {
"cpe": "cpe:2.3:h:vega:vegapuls6x_pn_hardware:*:*:*:*:*:*:*:*",
"model_numbers": [
"PS6X.????????????Y????????"
],
"x_generic_uris": [
{
"namespace": "https://www.vega.com/en-us/products/product-catalog/",
"uri": "https://www.vega.com/en-us/products/product-catalog/level/radar/vegapuls-6x"
}
]
}
}
}
],
"category": "product_family",
"name": "Hardware"
},
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "1.0.0",
"product": {
"name": "Firmware 1.0.0",
"product_id": "CSAFPID-21001",
"product_identification_helper": {
"cpe": "cpe:2.3:o:vega:vegapuls6x_pn_firmware:1.0.0:*:*:*:*:*:*:*",
"x_generic_uris": [
{
"namespace": "https://www.vega.com/en-us/products/product-catalog/",
"uri": "https://www.vega.com/en-us/products/product-catalog/level/radar/vegapuls-6x"
}
]
}
}
},
{
"category": "product_version",
"name": "1.1.0",
"product": {
"name": "Firmware 1.1.0",
"product_id": "CSAFPID-21002",
"product_identification_helper": {
"cpe": "cpe:2.3:o:vega:vegapuls6x_pn_firmware:1.1.0:*:*:*:*:*:*:*",
"x_generic_uris": [
{
"namespace": "https://www.vega.com/en-us/products/product-catalog/",
"uri": "https://www.vega.com/en-us/products/product-catalog/level/radar/vegapuls-6x"
}
]
}
}
},
{
"category": "product_version",
"name": "1.1.1",
"product": {
"name": "Firmware 1.1.1",
"product_id": "CSAFPID-22001",
"product_identification_helper": {
"cpe": "cpe:2.3:o:vega:vegapuls6x_pn_firmware:1.1.1:*:*:*:*:*:*:*",
"x_generic_uris": [
{
"namespace": "https://www.vega.com/en-us/products/product-catalog/",
"uri": "https://www.vega.com/en-us/products/product-catalog/level/radar/vegapuls-6x"
}
]
}
}
}
],
"category": "product_name",
"name": "VEGAPULS 6X Two-wire PROFINET, Modbus TCP, OPC UA (Ethernet-APL)"
}
],
"category": "product_family",
"name": "Firmware"
}
],
"category": "vendor",
"name": "VEGA Grieshaber KG"
}
],
"product_groups": [
{
"group_id": "CSAFGID-0001",
"product_ids": [
"CSAFPID-31001",
"CSAFPID-31002"
],
"summary": "Affected products."
}
],
"relationships": [
{
"category": "installed_on",
"full_product_name": {
"name": "Firmware 1.0.0 installed on VEGAPULS 6X Two-wire PROFINET, Modbus TCP, OPC UA (Ethernet-APL)",
"product_id": "CSAFPID-31001",
"product_identification_helper": {
"cpe": "cpe:2.3:o:vega:vegapuls6x_pn_firmware:1.0.0:*:*:*:*:*:*:*",
"model_numbers": [
"PS6X.????????????Y????????"
]
}
},
"product_reference": "CSAFPID-21001",
"relates_to_product_reference": "CSAFPID-11001"
},
{
"category": "installed_on",
"full_product_name": {
"name": "Firmware 1.1.0 installed on VEGAPULS 6X Two-wire PROFINET, Modbus TCP, OPC UA (Ethernet-APL)",
"product_id": "CSAFPID-31002",
"product_identification_helper": {
"cpe": "cpe:2.3:o:vega:vegapuls6x_pn_firmware:1.1.0:*:*:*:*:*:*:*",
"model_numbers": [
"PS6X.????????????Y????????"
]
}
},
"product_reference": "CSAFPID-21002",
"relates_to_product_reference": "CSAFPID-11001"
},
{
"category": "installed_on",
"full_product_name": {
"name": "Firmware 1.1.1 installed on VEGAPULS 6X Two-wire PROFINET, Modbus TCP, OPC UA (Ethernet-APL)",
"product_id": "CSAFPID-32001",
"product_identification_helper": {
"cpe": "cpe:2.3:o:vega:vegapuls6x_pn_firmware:1.1.1:*:*:*:*:*:*:*",
"model_numbers": [
"PS6X.????????????Y????????"
]
}
},
"product_reference": "CSAFPID-22001",
"relates_to_product_reference": "CSAFPID-11001"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-3323",
"cwe": {
"id": "CWE-306",
"name": "Missing Authentication for Critical Function"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An unsecured configuration interface on affected devices allows unauthenticated remote attackers to access sensitive information, including hashed credentials and access codes.",
"title": "CVE Description"
},
{
"category": "details",
"text": "Due to different bus and network interfaces the affected products have different CVSS vectors. Please see the scores listed in the CSAF for details.",
"title": "Vulnerability details"
}
],
"product_status": {
"fixed": [
"CSAFPID-32001"
],
"known_affected": [
"CSAFPID-31001",
"CSAFPID-31002"
]
},
"references": [
{
"category": "external",
"summary": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Disable the network service \u0027FDI over PROFINET\u0027 if not needed. Implement access control to physical interfaces to prevent unauthorized access.",
"product_ids": [
"CSAFPID-31001",
"CSAFPID-31002"
]
},
{
"category": "vendor_fix",
"details": "Update to fixed firmware versions listed in this advisory.\n\nRotate any credentials that were used on the affected devices as they may have been compromised.\n\nContact VEGA Support if rotating emergency codes is necessary based on your risk assessment.",
"product_ids": [
"CSAFPID-31001",
"CSAFPID-31002"
],
"restart_required": {
"category": "vulnerable_component",
"details": "A restart of the vulnerable component is required after applying the firmware update."
},
"url": "https://www.vega.com/en-us/downloads"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-31001",
"CSAFPID-31002"
]
}
],
"title": "Privilege escalation through unsecured configuration interface"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…