CVE-2023-3379

moderate-risk

Published 2023-11-20

Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker to change the passwords of other non-admin users and thus to escalate non-root privileges.

Do I need to act?

0.03% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.3/10 Medium

LOCAL / LOW complexity

Affected Products (13)

Compact Controller 100 Firmware

Edge Controller Firmware

Pfc100 Firmware

Pfc200 Firmware

Touch Panel 600 Advanced Firmware

Touch Panel 600 Marine Firmware

Touch Panel 600 Standard Firmware

Affected Vendors

Wago

References (2)

Third Party Advisory https://cert.vde.com/en/advisories/VDE-2023-015/

/ 100

moderate-risk

Severity 18/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 17/34 · Moderate