CVE-2016-9362

moderate-risk
Published 2017-02-13

An issue was discovered in WAGO 750-8202/PFC200 prior to FW04 (released August 2015), WAGO 750-881 prior to FW09 (released August 2016), and WAGO 0758-0874-0000-0111. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to edit and to view settings without authenticating.

Do I need to act?

-
0.35% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.1/10 Critical
NETWORK / LOW complexity

Affected Products (3)

758-Xxxx Series Firmware
750-Xxxx Series Firmware

Affected Vendors

Wago

References (4)

Third Party Advisory http://www.securityfocus.com/bid/95074
Third Party Advisory https://ics-cert.us-cert.gov/advisories/ICSA-16-357-02
Third Party Advisory http://www.securityfocus.com/bid/95074
Third Party Advisory https://ics-cert.us-cert.gov/advisories/ICSA-16-357-02
41
/ 100
moderate-risk
Severity 31/34 · Critical
Exploitability 1/34 · Minimal
Exposure 9/34 · Low