CVE-2022-3738

MEDIUM

WAGO PFC100/PFC200/TP600/CC100/Edge Controller FW 16-21 - Unauthenticated Sensitive Info Exposure

Title source: llm

Description

The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like credentials and cryptographic material. A valid user has to create a backup after the last reboot for this attack to be successfull.

References (1)

Core 1

Core References

Third Party Advisory

https://cert.vde.com/en/advisories/VDE-2022-054/

Scores

CVSS v3 5.9

EPSS 0.0063

EPSS Percentile 45.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-306

Status published

Products (7)

wago/cc100_firmware 16 - 22

wago/edge_controller_firmware 16 - 22

wago/pfc100_firmware 16 - 22

wago/pfc200_firmware 16 - 22

wago/touch_panel_600_advanced_firmware 16 - 22

wago/touch_panel_600_marine_firmware 16 - 22

wago/touch_panel_600_standard_firmware 16 - 22

Published Jan 19, 2023

Tracked Since Feb 18, 2026