CVE-2022-22511

lowpriority · track · 22EPSS 0.005 · 42 %ileDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.48% (42nd) EPSS

CVSS 3.5 · low

Is it mine?

39 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · wago_psirt

EPSS · scored 2026-10-27

Various configuration pages of the device are vulnerable to reflected XSS (Cross-Site Scripting) attacks. An authorized attacker with user privileges may use this to gain access to confidential information on a PC that connects to the WBM after it has been compromised.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

No vendor fix yet; a mitigation is available.

Mitigationwago_psirt
Restrict network access to the device Use strong passwords Do not directly connect the device to the internet Disable unused TCP/UDP-ports Please install upcoming FW-Update, which will be available at end of Q2/2022.

cvss

Technical severity, 0–10. One row per scoring source.

5.4

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 3.5–5.4

v2.03.5lowAV:N/AC:M/Au:S/C:N/I:P/A:Nprimary · NVD / NIST USexploitability 6.8 · impact 2.9

v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:Nprimary · NVD / NIST USexploitability 2.3 · impact 2.7

v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:Nsecondary · ENISA EU

v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:Nsecondary · info@cert.vde.comexploitability 2.3 · impact 2.7

v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:Nsecondary · WAGO PSIRT DE

v3.15mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-79USCWE-79US

affected products (39)

Products and version ranges known to be affected.

WAGO Compact Controller CC100 (751-9301)FW16 → FW22enisa_euvdEU
WAGO Edge Controller (752-8303/8000-002)FW16 → FW22enisa_euvdEU
WAGO Series PFC100 (750-81xx/xxx-xxx)FW16 → FW22enisa_euvdEU
WAGO Series PFC200 (750-82xx/xxx-xxx)FW16 → FW22enisa_euvdEU
WAGO Series Touch Panel 600 Advanced Line (762-5xxx)≤ FW16 FW22enisa_euvdEU
WAGO Series Touch Panel 600 Marine Line (762-6xxx)≤ FW16 FW22enisa_euvdEU
WAGO Series Touch Panel 600 Standard Line (762-4xxx)≤ FW16 FW22enisa_euvdEU
wago 750-8100 firmwarefw16 → fw22nvdUScpe:2.3:o:wago:750-8100_firmware:*:*:*:*:*:*:*:*
wago 750-8101 firmwarefw16 → fw22nvdUScpe:2.3:o:wago:750-8101_firmware:*:*:*:*:*:*:*:*
wago 750-8101/025-000 firmwarefw16 → fw22nvdUScpe:2.3:o:wago:750-8101\/025-000_firmware:*:*:*:*:*:*:*:*
wago 750-8102 firmwarefw16 → fw22nvdUScpe:2.3:o:wago:750-8102_firmware:*:*:*:*:*:*:*:*
wago 750-8102/025-000 firmwarefw16 → fw22nvdUScpe:2.3:o:wago:750-8102\/025-000_firmware:*:*:*:*:*:*:*:*
wago 750-82 firmwarefw16 → fw22nvdUScpe:2.3:o:wago:750-82_firmware:*:*:*:*:*:*:*:*
wago 750-8202 firmwarefw16 → fw22nvdUScpe:2.3:o:wago:750-8202_firmware:*:*:*:*:*:*:*:*
wago 750-8202/000-012 firmwarefw16 → fw22nvdUScpe:2.3:o:wago:750-8202\/000-012_firmware:*:*:*:*:*:*:*:*
wago 750-8202/000-022 firmwarefw16 → fw22nvdUScpe:2.3:o:wago:750-8202\/000-022_firmware:*:*:*:*:*:*:*:*
wago 750-8202/025-000 firmwarefw16 → fw22nvdUScpe:2.3:o:wago:750-8202\/025-000_firmware:*:*:*:*:*:*:*:*
wago 750-8202/025-001 firmwarefw16 → fw22nvdUScpe:2.3:o:wago:750-8202\/025-001_firmware:*:*:*:*:*:*:*:*
wago 751-9301 firmwarefw16 → fw22nvdUScpe:2.3:o:wago:751-9301_firmware:*:*:*:*:*:*:*:*
wago 752-8303/8000-002 firmwarefw16 → fw22nvdUScpe:2.3:o:wago:752-8303\/8000-002_firmware:*:*:*:*:*:*:*:*

showing 20 of 39

advisories (1)

Vendor and ecosystem advisories describing this.

VDE-2022-004WAGO: Web-Based Management Cross-Site Scripting2022-03-09csaf · wago_psirtDE
The Web-Based Management (WBM) of WAGOs programmable logic controller (PLC) is typically used for administration, commissioning and updates.Various configuration pages of the device are vulnerable to reflected XSS (Cross-Site Scripting) attacks.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd wago_psirt NVD CVE.org MITRE

published 2022-03-09modified 2026-06-17

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan