CVE-2018-12981

MEDIUM

WAGO e!DISPLAY 762-3000-762-3003 < FW 02 - Cross-Site Scripting via Web Server Request

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-12981. PoCs published by SEC Consult.

AI-analyzed exploit summary The document describes multiple vulnerabilities in WAGO e!DISPLAY 7300T, including XSS, file upload manipulation, and remote code execution via chained exploits. It provides proof-of-concept examples for reflected and stored XSS attacks.

Description

An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. The vulnerability can be exploited by authenticated and unauthenticated users by sending special crafted requests to the web server allowing injecting code within the WBM. The code will be rendered and/or executed in the browser of the user's browser.

Exploits (1)

exploitdb WRITEUP VERIFIED
by SEC Consult · textwebappsphp
https://www.exploit-db.com/exploits/45014

The document describes multiple vulnerabilities in WAGO e!DISPLAY 7300T, including XSS, file upload manipulation, and remote code execution via chained exploits. It provides proof-of-concept examples for reflected and stored XSS attacks.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Moderate
Reliability
Reliable
Target: WAGO e!DISPLAY 7300T - WP 4.3 480x272 PIO1 (FW 01 - 01.01.10(01))
No auth needed
Prerequisites: Network access to the target device
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (6)

Core 6
Core References
Third Party Advisory x_refsource_misc
https://cert.vde.com/en-us/advisories/vde-2018-010
Third Party Advisory, US Government Resource x_refsource_misc
https://ics-cert.us-cert.gov/advisories/ICSA-18-198-02
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/45014/
Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2018/Jul/38

Scores

CVSS v3 5.4
EPSS 0.0517
EPSS Percentile 91.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (4)
wago/762-3000_firmware < 02
wago/762-3001_firmware < 02
wago/762-3002_firmware < 02
wago/762-3003_firmware < 02
Published Jul 12, 2018
Tracked Since Feb 18, 2026