CVE-2018-12980

HIGH

WAGO e!DISPLAY 762-3000/3001/3002/3003 < FW 02 - Authenticated Arbitrary File Upload

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-12980. PoCs published by SEC Consult.

AI-analyzed exploit summary The document describes multiple vulnerabilities in WAGO e!DISPLAY 7300T, including XSS, file upload manipulation, and remote code execution via chained exploits. It provides proof-of-concept examples for reflected and stored XSS attacks.

Description

An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. The vulnerability allows an authenticated user to upload arbitrary files to the file system with the permissions of the web server.

Exploits (1)

exploitdb WRITEUP VERIFIED
by SEC Consult · textwebappsphp
https://www.exploit-db.com/exploits/45014

The document describes multiple vulnerabilities in WAGO e!DISPLAY 7300T, including XSS, file upload manipulation, and remote code execution via chained exploits. It provides proof-of-concept examples for reflected and stored XSS attacks.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Moderate
Reliability
Reliable
Target: WAGO e!DISPLAY 7300T - WP 4.3 480x272 PIO1 (FW 01 - 01.01.10(01))
No auth needed
Prerequisites: Network access to the target device
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (6)

Core 6
Core References
Third Party Advisory x_refsource_misc
https://cert.vde.com/en-us/advisories/vde-2018-010
Third Party Advisory, US Government Resource x_refsource_misc
https://ics-cert.us-cert.gov/advisories/ICSA-18-198-02
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/45014/
Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2018/Jul/38

Scores

CVSS v3 8.8
EPSS 0.3014
EPSS Percentile 98.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-434
Status published
Products (4)
wago/762-3000_firmware < 02
wago/762-3001_firmware < 02
wago/762-3002_firmware < 02
wago/762-3003_firmware < 02
Published Jul 12, 2018
Tracked Since Feb 18, 2026