Vulnerability-Lookup

VDE-2026-047

Vulnerability from csaf_vegagrieshaberkg - Published: 2026-05-04 06:00 - Updated: 2026-06-22 10:00

Summary

VEGA: Missing Authentication for critical function in VEGAPULS Air products

Severity

Medium

Notes

Summary: Vulnerable components expose sensitive information to unauthorized actors through an unsecured configuration interface. Vulnerable firmware releases contain an unsecured configuration interface that allows retrieval of sensitive information such as hashed credentials. It was found that users with no or low rights can access information from devices that should not be available to them. An attacker can use this information to impersonate authorized users.

Impact: An authenticated attacker can obtain sensitive information, potentially enabling authenticated device modification.

Mitigation: Implement access controls for interfaces to prevent unauthorized access.

Remediation: Update to the fixed firmware versions listed in this advisory. Rotate any credentials used on affected devices as they may have been compromised. Contact VEGA Support if emergency code rotation is necessary based on your risk assessment. Fixed Versions: * Firmware 2.2.1 installed on VEGAPULS Air 41 Cellular (NB-IoT/LTE-M) + LoRa * Firmware 2.2.1 installed on VEGAPULS Air 41 Cellular (NB-IoT/LTE-M) * Firmware 2.2.1 installed on VEGAPULS Air 41 LoRa * Firmware 2.2.1 installed on VEGAPULS Air 42 Cellular (NB-IoT/LTE-M) + LoRa * Firmware 2.2.1 installed on VEGAPULS Air 42 Cellular (NB-IoT/LTE-M) * Firmware 2.2.1 installed on VEGAPULS Air 42 LoRa

General Recommendation: Implement access controls for interfaces to prevent unauthorized access.

CVE-2026-3323

An unsecured configuration interface on the affected devices allows an authenticated remote attacker to gain sensitive information like hashed credentials and access codes.

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-306 - Missing Authentication for Critical Function

Affected products

Fixed 6 products

Product	Identifier	Version	Remediation
Unresolved product id: CSAFPID-32001		—
Unresolved product id: CSAFPID-32002		—
Unresolved product id: CSAFPID-32003		—
Unresolved product id: CSAFPID-32004		—
Unresolved product id: CSAFPID-32005		—
Unresolved product id: CSAFPID-32006		—

Known affected 7 products

Product	Version	Remediation
Unresolved product id: CSAFPID-31001	—	Mitigation Vendor Fix fix
Unresolved product id: CSAFPID-31002	—	Mitigation Vendor Fix fix
Unresolved product id: CSAFPID-31003	—	Mitigation Vendor Fix fix
Unresolved product id: CSAFPID-31004	—	Mitigation Vendor Fix fix
Unresolved product id: CSAFPID-31005	—	Mitigation Vendor Fix fix
Unresolved product id: CSAFPID-31006	—	Mitigation Vendor Fix fix
CVE-2026-3323 Reference Score VEGA Grieshaber KG / Firmware	—

References

5 references

URL	Category
https://www.vega.com/en-us/company/legal-notice/i…	external
https://certvde.com/en/advisories/vendor/vega	external
https://certvde.com/en/advisories/VDE-2026-047	self
https://vega.csaf-tp.certvde.com/.well-known/csaf…	self
https://www.first.org/cvss/calculator/4.0#CVSS:4.…	external

Acknowledgments

CERT@VDE certvde.com

Product Security Unit at VEGA Grieshaber KG www.vega.com

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      },
      {
        "organization": "Product Security Unit at VEGA Grieshaber KG",
        "summary": "reporting",
        "urls": [
          "https://www.vega.com"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale",
      "text": "medium"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "summary",
        "text": "Vulnerable components expose sensitive information to unauthorized actors through an unsecured configuration interface. Vulnerable firmware releases contain an unsecured configuration interface that allows retrieval of sensitive information such as hashed credentials.\n\nIt was found that users with no or low rights can access information from devices that should not be available to them.\n\nAn attacker can use this information to impersonate authorized users.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "An authenticated attacker can obtain sensitive information, potentially enabling authenticated device modification.",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "Implement access controls for interfaces to prevent unauthorized access.",
        "title": "Mitigation"
      },
      {
        "category": "description",
        "text": "Update to the fixed firmware versions listed in this advisory. Rotate any credentials used on affected devices as they may have been compromised. Contact VEGA Support if emergency code rotation is necessary based on your risk assessment.\n\nFixed Versions:\n* Firmware 2.2.1 installed on VEGAPULS Air 41 Cellular (NB-IoT/LTE-M) + LoRa\n* Firmware 2.2.1 installed on VEGAPULS Air 41 Cellular (NB-IoT/LTE-M)\n* Firmware 2.2.1 installed on VEGAPULS Air 41 LoRa\n* Firmware 2.2.1 installed on VEGAPULS Air 42 Cellular (NB-IoT/LTE-M) + LoRa\n* Firmware 2.2.1 installed on VEGAPULS Air 42 Cellular (NB-IoT/LTE-M)\n* Firmware 2.2.1 installed on VEGAPULS Air 42 LoRa",
        "title": "Remediation"
      },
      {
        "category": "general",
        "text": "Implement access controls for interfaces to prevent unauthorized access.",
        "title": "General Recommendation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@vega.com",
      "name": "VEGA Grieshaber KG",
      "namespace": "https://vega.com"
    },
    "references": [
      {
        "category": "external",
        "summary": "VEGA Grieshaber PSIRT",
        "url": "https://www.vega.com/en-us/company/legal-notice/information-on-cyber-security"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for VEGA Grieshaber",
        "url": "https://certvde.com/en/advisories/vendor/vega"
      },
      {
        "category": "self",
        "summary": "VDE-2026-047: VEGA: Missing Authentication for critical function in VEGAPULS Air products - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2026-047"
      },
      {
        "category": "self",
        "summary": "VDE-2026-047: VEGA: Missing Authentication for critical function in VEGAPULS Air products - CSAF",
        "url": "https://vega.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-047.json"
      }
    ],
    "title": "VEGA: Missing Authentication for critical function in VEGAPULS Air products",
    "tracking": {
      "aliases": [
        "VDE-2026-047"
      ],
      "current_release_date": "2026-06-22T10:00:00.000Z",
      "generator": {
        "date": "2026-06-22T09:45:24.586Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.44"
        }
      },
      "id": "VDE-2026-047",
      "initial_release_date": "2026-05-04T06:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-05-04T06:00:00.000Z",
          "number": "1.0.0",
          "summary": "Initial Release"
        },
        {
          "date": "2026-05-04T09:05:00.000Z",
          "number": "1.0.1",
          "summary": "Updated Title"
        },
        {
          "date": "2026-06-22T10:00:00.000Z",
          "number": "1.0.2",
          "summary": "Added fixed Versions to Remediation document notes"
        }
      ],
      "status": "final",
      "version": "1.0.2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "VEGAPULS Air 41 Cellular (NB-IoT/LTE-M) + LoRa",
                "product": {
                  "name": "VEGAPULS Air 41 Cellular (NB-IoT/LTE-M) + LoRa",
                  "product_id": "CSAFPID-11001",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:h:vega:vegapulsair41_cellularlora_hardware:*:*:*:*:*:*:*:*",
                    "model_numbers": [
                      "PSA41.*****N***"
                    ],
                    "x_generic_uris": [
                      {
                        "namespace": "https://www.vega.com/en-us/products/product-catalog/",
                        "uri": "https://www.vega.com/en-us/products/product-catalog/level/radar/vegapuls-air-41"
                      }
                    ]
                  }
                }
              },
              {
                "category": "product_name",
                "name": "VEGAPULS Air 41 Cellular (NB-IoT/LTE-M)",
                "product": {
                  "name": "VEGAPULS Air 41 Cellular (NB-IoT/LTE-M)",
                  "product_id": "CSAFPID-11002",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:h:vega:vegapulsair41_cellular_hardware:*:*:*:*:*:*:*:*",
                    "model_numbers": [
                      "PSA41.*****C***"
                    ],
                    "x_generic_uris": [
                      {
                        "namespace": "https://www.vega.com/en-us/products/product-catalog/",
                        "uri": "https://www.vega.com/en-us/products/product-catalog/level/radar/vegapuls-air-41"
                      }
                    ]
                  }
                }
              },
              {
                "category": "product_name",
                "name": "VEGAPULS Air 41 LoRa",
                "product": {
                  "name": "VEGAPULS Air 41 LoRa",
                  "product_id": "CSAFPID-11003",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:h:vega:vegapulsair41_lora_hardware:*:*:*:*:*:*:*:*",
                    "model_numbers": [
                      "PSA41.*****L***"
                    ],
                    "x_generic_uris": [
                      {
                        "namespace": "https://www.vega.com/en-us/products/product-catalog/",
                        "uri": "https://www.vega.com/en-us/products/product-catalog/level/radar/vegapuls-air-41"
                      }
                    ]
                  }
                }
              },
              {
                "category": "product_name",
                "name": "VEGAPULS Air 42 Cellular (NB-IoT/LTE-M) + LoRa",
                "product": {
                  "name": "VEGAPULS Air 42 Cellular (NB-IoT/LTE-M) + LoRa",
                  "product_id": "CSAFPID-11004",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:h:vega:vegapulsair42_cellularlora_hardware:*:*:*:*:*:*:*:*",
                    "model_numbers": [
                      "PSA42.*****N***"
                    ],
                    "x_generic_uris": [
                      {
                        "namespace": "https://www.vega.com/en-us/products/product-catalog/",
                        "uri": "https://www.vega.com/en-us/products/product-catalog/level/radar/vegapuls-air-42"
                      }
                    ]
                  }
                }
              },
              {
                "category": "product_name",
                "name": "VEGAPULS Air 42 Cellular (NB-IoT/LTE-M)",
                "product": {
                  "name": "VEGAPULS Air 42 Cellular (NB-IoT/LTE-M)",
                  "product_id": "CSAFPID-11005",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:h:vega:vegapulsair42_cellular_hardware:*:*:*:*:*:*:*:*",
                    "model_numbers": [
                      "PSA42.*****C***"
                    ],
                    "x_generic_uris": [
                      {
                        "namespace": "https://www.vega.com/en-us/products/product-catalog/",
                        "uri": "https://www.vega.com/en-us/products/product-catalog/level/radar/vegapuls-air-42"
                      }
                    ]
                  }
                }
              },
              {
                "category": "product_name",
                "name": "VEGAPULS Air 42 LoRa",
                "product": {
                  "name": "VEGAPULS Air 42 LoRa",
                  "product_id": "CSAFPID-11006",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:h:vega:vegapulsair42_lora_hardware:*:*:*:*:*:*:*:*",
                    "model_numbers": [
                      "PSA42.*****L***"
                    ],
                    "x_generic_uris": [
                      {
                        "namespace": "https://www.vega.com/en-us/products/product-catalog/",
                        "uri": "https://www.vega.com/en-us/products/product-catalog/level/radar/vegapuls-air-42"
                      }
                    ]
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Hardware"
          },
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:generic/\u003c2.2.1",
                    "product": {
                      "name": "Firmware \u003c 2.2.1",
                      "product_id": "CSAFPID-21001",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:o:vega:vegapulsair41_cellularlora_firmware:*:*:*:*:*:*:*:*",
                        "x_generic_uris": [
                          {
                            "namespace": "https://www.vega.com/en-us/products/product-catalog/",
                            "uri": "https://www.vega.com/en-us/products/product-catalog/level/radar/vegapuls-air-41"
                          }
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "2.2.1",
                    "product": {
                      "name": "Firmware 2.2.1",
                      "product_id": "CSAFPID-22001",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:o:vega:vegapulsair41_cellularlora_firmware:2.2.1:*:*:*:*:*:*:*",
                        "x_generic_uris": [
                          {
                            "namespace": "https://www.vega.com/en-us/products/product-catalog/",
                            "uri": "https://www.vega.com/en-us/products/product-catalog/level/radar/vegapuls-air-41"
                          }
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "VEGAPULS Air 41 Cellular (NB-IoT/LTE-M) + LoRa"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:generic/\u003c2.2.1",
                    "product": {
                      "name": "Firmware \u003c 2.2.1",
                      "product_id": "CSAFPID-21002",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:o:vega:vegapulsair41_cellular_firmware:*:*:*:*:*:*:*:*",
                        "x_generic_uris": [
                          {
                            "namespace": "https://www.vega.com/en-us/products/product-catalog/",
                            "uri": "https://www.vega.com/en-us/products/product-catalog/level/radar/vegapuls-air-41"
                          }
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "2.2.1",
                    "product": {
                      "name": "Firmware 2.2.1",
                      "product_id": "CSAFPID-22002",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:o:vega:vegapulsair41_cellular_firmware:2.2.1:*:*:*:*:*:*:*",
                        "x_generic_uris": [
                          {
                            "namespace": "https://www.vega.com/en-us/products/product-catalog/",
                            "uri": "https://www.vega.com/en-us/products/product-catalog/level/radar/vegapuls-air-41"
                          }
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "VEGAPULS Air 41 Cellular (NB-IoT/LTE-M)"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:generic/\u003c2.2.1",
                    "product": {
                      "name": "Firmware \u003c 2.2.1",
                      "product_id": "CSAFPID-21003",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:o:vega:vegapulsair41_lora_firmware:*:*:*:*:*:*:*:*",
                        "x_generic_uris": [
                          {
                            "namespace": "https://www.vega.com/en-us/products/product-catalog/",
                            "uri": "https://www.vega.com/en-us/products/product-catalog/level/radar/vegapuls-air-41"
                          }
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "2.2.1",
                    "product": {
                      "name": "Firmware 2.2.1",
                      "product_id": "CSAFPID-22003",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:o:vega:vegapulsair41_lora_firmware:2.2.1:*:*:*:*:*:*:*",
                        "x_generic_uris": [
                          {
                            "namespace": "https://www.vega.com/en-us/products/product-catalog/",
                            "uri": "https://www.vega.com/en-us/products/product-catalog/level/radar/vegapuls-air-41"
                          }
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "VEGAPULS Air 41 LoRa"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:generic/\u003c2.2.1",
                    "product": {
                      "name": "Firmware \u003c 2.2.1",
                      "product_id": "CSAFPID-21004",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:o:vega:vegapulsair42_cellularlora_firmware:*:*:*:*:*:*:*:*",
                        "x_generic_uris": [
                          {
                            "namespace": "https://www.vega.com/en-us/products/product-catalog/",
                            "uri": "https://www.vega.com/en-us/products/product-catalog/level/radar/vegapuls-air-42"
                          }
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "2.2.1",
                    "product": {
                      "name": "Firmware 2.2.1",
                      "product_id": "CSAFPID-22004",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:o:vega:vegapulsair42_cellularlora_firmware:2.2.1:*:*:*:*:*:*:*",
                        "x_generic_uris": [
                          {
                            "namespace": "https://www.vega.com/en-us/products/product-catalog/",
                            "uri": "https://www.vega.com/en-us/products/product-catalog/level/radar/vegapuls-air-42"
                          }
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "VEGAPULS Air 42 Cellular (NB-IoT/LTE-M) + LoRa"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:generic/\u003c2.2.1",
                    "product": {
                      "name": "Firmware \u003c 2.2.1",
                      "product_id": "CSAFPID-21005",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:o:vega:vegapulsair42_cellular_firmware:*:*:*:*:*:*:*:*",
                        "x_generic_uris": [
                          {
                            "namespace": "https://www.vega.com/en-us/products/product-catalog/",
                            "uri": "https://www.vega.com/en-us/products/product-catalog/level/radar/vegapuls-air-42"
                          }
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "2.2.1",
                    "product": {
                      "name": "Firmware 2.2.1",
                      "product_id": "CSAFPID-22005",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:o:vega:vegapulsair42_cellular_firmware:2.2.1:*:*:*:*:*:*:*",
                        "x_generic_uris": [
                          {
                            "namespace": "https://www.vega.com/en-us/products/product-catalog/",
                            "uri": "https://www.vega.com/en-us/products/product-catalog/level/radar/vegapuls-air-42"
                          }
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "VEGAPULS Air 42 Cellular (NB-IoT/LTE-M)"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:generic/\u003c2.2.1",
                    "product": {
                      "name": "Firmware \u003c 2.2.1",
                      "product_id": "CSAFPID-21006",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:o:vega:vegapulsair42_lora_firmware:*:*:*:*:*:*:*:*",
                        "x_generic_uris": [
                          {
                            "namespace": "https://www.vega.com/en-us/products/product-catalog/",
                            "uri": "https://www.vega.com/en-us/products/product-catalog/level/radar/vegapuls-air-42"
                          }
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "2.2.1",
                    "product": {
                      "name": "Firmware 2.2.1",
                      "product_id": "CSAFPID-22006",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:o:vega:vegapulsair42_lora_firmware:2.2.1:*:*:*:*:*:*:*",
                        "x_generic_uris": [
                          {
                            "namespace": "https://www.vega.com/en-us/products/product-catalog/",
                            "uri": "https://www.vega.com/en-us/products/product-catalog/level/radar/vegapuls-air-42"
                          }
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "VEGAPULS Air 42 LoRa"
              },
              {
                "category": "product_name",
                "name": "CVE Reference Score",
                "product": {
                  "name": "CVE-2026-3323 Reference Score",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_family",
            "name": "Firmware"
          }
        ],
        "category": "vendor",
        "name": "VEGA Grieshaber KG"
      }
    ],
    "product_groups": [
      {
        "group_id": "CSAFGID-0001",
        "product_ids": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006"
        ],
        "summary": "Affected products."
      }
    ],
    "relationships": [
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c 2.2.1 installed on VEGAPULS Air 41 Cellular (NB-IoT/LTE-M) + LoRa",
          "product_id": "CSAFPID-31001",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:vega:vegapulsair41_cellularlora_firmware:*:*:*:*:*:*:*:*",
            "model_numbers": [
              "PSA41.*****N***"
            ]
          }
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 2.2.1 installed on VEGAPULS Air 41 Cellular (NB-IoT/LTE-M) + LoRa",
          "product_id": "CSAFPID-32001",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:vega:vegapulsair41_cellularlora_firmware:2.2.1:*:*:*:*:*:*:*",
            "model_numbers": [
              "PSA41.*****N***"
            ]
          }
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c 2.2.1 installed on VEGAPULS Air 41 Cellular (NB-IoT/LTE-M)",
          "product_id": "CSAFPID-31002",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:vega:vegapulsair41_cellular_firmware:*:*:*:*:*:*:*:*",
            "model_numbers": [
              "PSA41.*****C***"
            ]
          }
        },
        "product_reference": "CSAFPID-21002",
        "relates_to_product_reference": "CSAFPID-11002"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 2.2.1 installed on VEGAPULS Air 41 Cellular (NB-IoT/LTE-M)",
          "product_id": "CSAFPID-32002",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:vega:vegapulsair41_cellular_firmware:2.2.1:*:*:*:*:*:*:*",
            "model_numbers": [
              "PSA41.*****C***"
            ]
          }
        },
        "product_reference": "CSAFPID-22002",
        "relates_to_product_reference": "CSAFPID-11002"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c 2.2.1 installed on VEGAPULS Air 41 LoRa",
          "product_id": "CSAFPID-31003",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:vega:vegapulsair41_lora_firmware:*:*:*:*:*:*:*:*",
            "model_numbers": [
              "PSA41.*****L***"
            ]
          }
        },
        "product_reference": "CSAFPID-21003",
        "relates_to_product_reference": "CSAFPID-11003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 2.2.1 installed on VEGAPULS Air 41 LoRa",
          "product_id": "CSAFPID-32003",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:vega:vegapulsair41_lora_firmware:2.2.1:*:*:*:*:*:*:*",
            "model_numbers": [
              "PSA41.*****L***"
            ]
          }
        },
        "product_reference": "CSAFPID-22003",
        "relates_to_product_reference": "CSAFPID-11003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c 2.2.1 installed on VEGAPULS Air 42 Cellular (NB-IoT/LTE-M) + LoRa",
          "product_id": "CSAFPID-31004",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:vega:vegapulsair42_cellularlora_firmware:*:*:*:*:*:*:*:*",
            "model_numbers": [
              "PSA42.*****N***"
            ]
          }
        },
        "product_reference": "CSAFPID-21004",
        "relates_to_product_reference": "CSAFPID-11004"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 2.2.1 installed on VEGAPULS Air 42 Cellular (NB-IoT/LTE-M) + LoRa",
          "product_id": "CSAFPID-32004",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:vega:vegapulsair42_cellularlora_firmware:2.2.1:*:*:*:*:*:*:*",
            "model_numbers": [
              "PSA42.*****N***"
            ]
          }
        },
        "product_reference": "CSAFPID-22004",
        "relates_to_product_reference": "CSAFPID-11004"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c 2.2.1 installed on VEGAPULS Air 42 Cellular (NB-IoT/LTE-M)",
          "product_id": "CSAFPID-31005",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:vega:vegapulsair42_cellular_firmware:*:*:*:*:*:*:*:*",
            "model_numbers": [
              "PSA42.*****C***"
            ]
          }
        },
        "product_reference": "CSAFPID-21005",
        "relates_to_product_reference": "CSAFPID-11005"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 2.2.1 installed on VEGAPULS Air 42 Cellular (NB-IoT/LTE-M)",
          "product_id": "CSAFPID-32005",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:vega:vegapulsair42_cellular_firmware:2.2.1:*:*:*:*:*:*:*",
            "model_numbers": [
              "PSA42.*****C***"
            ]
          }
        },
        "product_reference": "CSAFPID-22005",
        "relates_to_product_reference": "CSAFPID-11005"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c 2.2.1 installed on VEGAPULS Air 42 LoRa",
          "product_id": "CSAFPID-31006",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:vega:vegapulsair42_lora_firmware:*:*:*:*:*:*:*:*",
            "model_numbers": [
              "PSA42.*****L***"
            ]
          }
        },
        "product_reference": "CSAFPID-21006",
        "relates_to_product_reference": "CSAFPID-11006"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 2.2.1 installed on VEGAPULS Air 42 LoRa",
          "product_id": "CSAFPID-32006",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:vega:vegapulsair42_lora_firmware:2.2.1:*:*:*:*:*:*:*",
            "model_numbers": [
              "PSA42.*****L***"
            ]
          }
        },
        "product_reference": "CSAFPID-22006",
        "relates_to_product_reference": "CSAFPID-11006"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-3323",
      "cwe": {
        "id": "CWE-306",
        "name": "Missing Authentication for Critical Function"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "An unsecured configuration interface on the affected devices allows an authenticated remote attacker to gain sensitive information like hashed credentials and access codes.",
          "title": "CVE Description"
        },
        {
          "category": "details",
          "text": "Due to different bus and network interfaces the affected products have different CVSS vectors. Please see the scores listed in the CSAF for details.",
          "title": "Vulnerability details"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
          "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Implement access control to interfaces to prevent unauthorized access.",
          "product_ids": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to fixed firmware versions listed in this advisory.\n\nRotate any credentials that were used on the affected devices as they may have been compromised.\n\nContact VEGA Support if rotating emergency codes is necessary based on your risk assessment.",
          "product_ids": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006"
          ],
          "restart_required": {
            "category": "vulnerable_component",
            "details": "A restart of the vulnerable component is required after applying the firmware update."
          },
          "url": "https://www.vega.com/en-us/downloads"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 6.5,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 6.5,
            "temporalSeverity": "MEDIUM",
            "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006"
          ]
        },
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "Privilege escalation through unsecured configuration interface"
    }
  ]
}

CVE-2026-3323 (GCVE-0-2026-3323)

Vulnerability from cvelistv5 – Published: 2026-04-28 10:24 – Updated: 2026-04-28 12:11

Title

VEGA: Privilege escalation through unsecured configuration interface in VEGAPULS devices

Summary

An unsecured configuration interface on affected devices allows unauthenticated remote attackers to access sensitive information, including hashed credentials and access codes.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

CERTVDE

References

2 references

URL	Tags
https://certvde.com/en/advisories/VDE-2026-016	vendor-advisory
https://vega.csaf-tp.certvde.com/.well-known/csaf…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
VEGA Grieshaber	VEGAPULS 6X Two-wire PROFINET, Modbus TCP, OPC UA (Ethernet-APL)	Affected: 1.0.0
VEGA Grieshaber	VEGAPULS 6X Two-wire PROFINET, Modbus TCP, OPC UA (Ethernet-APL)	Affected: 1.1.0

Date Public

2026-04-22 10:00

Credits

Product Security Unit at VEGA Grieshaber KG

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-3323",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-28T12:10:38.211626Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-28T12:11:34.980Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "VEGAPULS 6X Two-wire PROFINET, Modbus TCP, OPC UA (Ethernet-APL)",
          "vendor": "VEGA Grieshaber",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "VEGAPULS 6X Two-wire PROFINET, Modbus TCP, OPC UA (Ethernet-APL)",
          "vendor": "VEGA Grieshaber",
          "versions": [
            {
              "status": "affected",
              "version": "1.1.0"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:vega:vegapuls6x_pn_firmware:1.0.0:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:vega:vegapuls6x_pn_firmware:1.1.0:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Product Security Unit at VEGA Grieshaber KG"
        }
      ],
      "datePublic": "2026-04-22T10:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An unsecured configuration interface on affected devices allows unauthenticated remote attackers to access sensitive information, including hashed credentials and access codes.\u003cbr\u003e"
            }
          ],
          "value": "An unsecured configuration interface on affected devices allows unauthenticated remote attackers to access sensitive information, including hashed credentials and access codes."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306 Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-28T10:24:19.411Z",
        "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
        "shortName": "CERTVDE"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://certvde.com/en/advisories/VDE-2026-016"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://vega.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-016.json"
        }
      ],
      "source": {
        "advisory": "VDE-2026-016",
        "defect": [
          "CERT@VDE#641966"
        ],
        "discovery": "INTERNAL"
      },
      "title": "VEGA: Privilege escalation through unsecured configuration interface in VEGAPULS devices",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
    "assignerShortName": "CERTVDE",
    "cveId": "CVE-2026-3323",
    "datePublished": "2026-04-28T10:24:19.411Z",
    "dateReserved": "2026-02-27T11:10:05.931Z",
    "dateUpdated": "2026-04-28T12:11:34.980Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

VDE-2026-047

CVE-2026-3323 (GCVE-0-2026-3323)

Tags

Sightings

Nomenclature