WAGO: Missing Authentication for Critical Function

9.8 CVSS

Vulnerability Description

The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API. The vulnerability allows an unauthenticated attacker to read and set several device parameters that can lead to full compromise of the device.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-45138

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Ryan Pickren of Georgia Institute of Technologys Cyber-Physical Security Lab

References

https://cert.vde.com/en/advisories/VDE-2022-060/

More from WAGO

View All →

CVE-2025-41732

Stack-based buffer overflow via unsafe sscanf in check_cookie()

Critical 9.8

CVE-2025-41730

Stack-based buffer overflow via unsafe sscanf in check_account()

Critical 9.8

CVE-2025-41716

Unauthenticated User Enumeration via Missing Authentication

Medium 5.3

CVE-2025-41715

Missing Authentication for Database Access in Web Application

Critical 9.8

CVE-2025-41713

WAGO: Vulnerability in hardware switch circuit

Medium 6.5

Affected Vendor

WAGO

View all reports →

Affected Software

Compact Controller CC100 (751-9301), Edge Controller (752-8303/8000-002), PFC100 (750-81xx/xxx-xxx), PFC200 (750-82xx/xxx-xxx), Touch Panel 600 Advanced Line (762-5xxx), Touch Panel 600 Marine Line (762-6xxx), Touch Panel 600 Standard Line (762-4xxx)

Vulnerable Versions:

FW16, FW22 Patch 1, FW23, FW18