WAGO: Origin validation error through CORS misconfiguration

5.3 CVSS

Vulnerability Description

A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of information readable the impact only affects a small subset of confidentiality.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-45139

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Ryan Pickren of Georgia Institute of Technologys Cyber-Physical Security Lab

References

https://cert.vde.com/en/advisories/VDE-2022-060/

More from WAGO

View All →

CVE-2025-41732

Stack-based buffer overflow via unsafe sscanf in check_cookie()

Critical 9.8

CVE-2025-41730

Stack-based buffer overflow via unsafe sscanf in check_account()

Critical 9.8

CVE-2025-41716

Unauthenticated User Enumeration via Missing Authentication

Medium 5.3

CVE-2025-41715

Missing Authentication for Database Access in Web Application

Critical 9.8

CVE-2025-41713

WAGO: Vulnerability in hardware switch circuit

Medium 6.5

Affected Vendor

WAGO

View all reports →

Affected Software

Compact Controller CC100 (751-9301), Edge Controller (752-8303/8000-002), PFC100 (750-81xx/xxx-xxx), PFC200 (750-82xx/xxx-xxx), Touch Panel 600 Advanced Line (762-5xxx), Touch Panel 600 Marine Line (762-6xxx), Touch Panel 600 Standard Line (762-4xxx)

Vulnerable Versions:

FW16, FW22 Patch 1, FW23, FW18