CVE-2023-3379

MEDIUM

WAGO Compact Controller 100 Firmware <25 - Authenticated Privilege Escalation via Password Change

Title source: llm

Description

Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker to change the passwords of other non-admin users and thus to escalate non-root privileges.

References (1)

Core 1

Core References

Third Party Advisory

https://cert.vde.com/en/advisories/VDE-2023-015/

Scores

CVSS v3 5.3

EPSS 0.0020

EPSS Percentile 9.5%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Details

CWE

CWE-863

Status published

Products (11)

wago/compact_controller_100_firmware < 25

wago/edge_controller_firmware < 25

wago/pfc100_firmware 22 (2 CPE variants)

wago/pfc100_firmware < 22

wago/pfc200_firmware 22 (2 CPE variants)

wago/pfc200_firmware 23

wago/pfc200_firmware 24

wago/pfc200_firmware < 22

wago/touch_panel_600_advanced_firmware < 25

wago/touch_panel_600_marine_firmware < 25

... and 1 more

Published Nov 20, 2023

Tracked Since Feb 18, 2026