WAGO: Missing Authentication for Critical Function

9.8 CVSS

Vulnerability Description

The configuration backend allows an unauthenticated user to write arbitrary data with root privileges to the storage, which could lead to unauthenticated remote code execution and full system compromise.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-45140

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Ryan Pickren of Georgia Institute of Technologys Cyber-Physical Security Lab

References

https://cert.vde.com/en/advisories/VDE-2022-060/

More from WAGO

View All →

CVE-2025-41732

Stack-based buffer overflow via unsafe sscanf in check_cookie()

Critical 9.8

CVE-2025-41730

Stack-based buffer overflow via unsafe sscanf in check_account()

Critical 9.8

CVE-2025-41716

Unauthenticated User Enumeration via Missing Authentication

Medium 5.3

CVE-2025-41715

Missing Authentication for Database Access in Web Application

Critical 9.8

CVE-2025-41713

WAGO: Vulnerability in hardware switch circuit

Medium 6.5

Affected Vendor

WAGO

View all reports →

Affected Software

Compact Controller CC100 (751-9301), Edge Controller (752-8303/8000-002), PFC100 (750-81xx/xxx-xxx), PFC200 (750-82xx/xxx-xxx), Touch Panel 600 Advanced Line (762-5xxx), Touch Panel 600 Marine Line (762-6xxx), Touch Panel 600 Standard Line (762-4xxx)

Vulnerable Versions:

FW16, FW22 Patch 1, FW23