CVE-2023-4089

lowPriorität · verfolgen · 0EPSS 0.006 · 50. PerzentilDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.63% (50th) EPSS

CVSS 2.7 · low

Is it mine?

83 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · bewertet 2026-10-27

On affected Wago products an remote attacker with administrative privileges can access files to which he has already access to through an undocumented local file inclusion. This access is logged in a different log file than expected.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

Behobenwago_psirt
Update to Firmware 4.7.1 (FW29), Firmware 03.10.11 (FW22 Patch 2). For the latest Custom Firmware, please contact the WAGO support.
MitigationCompact Controller CC100cisa_csaf_ot
As general security measures strongly WAGO recommends:
MitigationEdge Controllercisa_csaf_ot
As general security measures strongly WAGO recommends:
MitigationPFC100cisa_csaf_ot
As general security measures strongly WAGO recommends:
MitigationPFC200cisa_csaf_ot
As general security measures strongly WAGO recommends:
MitigationTouch Panel 600 Advanced Linecisa_csaf_ot
As general security measures strongly WAGO recommends:
MitigationTouch Panel 600 Marine Linecisa_csaf_ot
As general security measures strongly WAGO recommends:
MitigationTouch Panel 600 Standard Linecisa_csaf_ot
As general security measures strongly WAGO recommends:

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

2.7

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.12.7lowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:Nsecondary · CISA US

v3.12.7lowAV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:Nsecondary · FSTEC (BDU) RU

v3.12.7lowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:Nsecondary · ENISA EU

v3.12.7lowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:Nsecondary · info@cert.vde.comAusnutzbarkeit 1.2 · Auswirkung 1.4

v3.12.7lowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:Nsecondary · WAGO PSIRT DE

v3.12.5lowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-610USCWE-610USCWE-610USCWE-610US

betroffene Produkte (83)

Betroffene Produkte und Versionsbereiche.

Compact Controller CC100: >FW19_up_to_and_including_FW26alle Versionencisa_csaf_otUS
Edge Controller: >FW18_up_to_and_including_FW26alle Versionencisa_csaf_otUS
PFC100: >FW16_up_to_and_including_FW26alle Versionencisa_csaf_otUS
PFC200: >FW16_up_to_and_including_FW26alle Versionencisa_csaf_otUS
Touch Panel 600 Advanced Line: >FW16_up_to_and_including_FW26alle Versionencisa_csaf_otUS
Touch Panel 600 Marine Line: >FW16_up_to_and_including_FW26alle Versionencisa_csaf_otUS
Touch Panel 600 Standard Line: >FW16_up_to_and_including_FW26alle Versionencisa_csaf_otUS
WAGO Compact Controller CC100≥ FW19_up_to_and_including_FW26cisa_csaf_otUS
WAGO Edge Controller≥ FW18_up_to_and_including_FW26cisa_csaf_otUS
WAGO PFC100≥ FW16_up_to_and_including_FW26cisa_csaf_otUS
WAGO PFC200≥ FW16_up_to_and_including_FW26cisa_csaf_otUS
WAGO Touch Panel 600 Advanced Line≥ FW16_up_to_and_including_FW26cisa_csaf_otUS
WAGO Touch Panel 600 Marine Line≥ FW16_up_to_and_including_FW26cisa_csaf_otUS
WAGO Touch Panel 600 Standard Line≥ FW16_up_to_and_including_FW26cisa_csaf_otUS
WAGO Compact Controller CC100≤ FW19 ≤FW26enisa_euvdEU
WAGO Edge Controller≤ FW18 ≤FW26enisa_euvdEU
WAGO PFC100≤ FW16 ≤FW26enisa_euvdEU
WAGO PFC200≤ FW16 ≤FW26enisa_euvdEU
WAGO Touch Panel 600 Advanced Line≤ FW16 ≤FW26enisa_euvdEU
WAGO Touch Panel 600 Marine Line≤ FW16 ≤FW26enisa_euvdEU

20 von 83 angezeigt

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

VDE-2023-046WAGO: Multiple products vulnerable to local file inclusion2023-10-23csaf · wago_psirtDE
An attacker with administrative privileges which can access sensitive files, can additionally access them in an unintended, undocumented way.
ICSA-23-325-01WAGO PFC200 Series2023-11-21icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow an attacker with administrative privileges can access sensitive files in an unintended, undocumented way.

auch bekannt als (5)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot wago_psirt NVD CVE.org MITRE

veröffentlicht 2023-10-17geändert 2026-06-17

Referenzen (5)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan