CVE-2018-16210

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-10-12 · updated 2026-06-17
Weakness: CWE-79

Description

WAGO 750-88X and WAGO 750-89X Ethernet Controller devices, versions 01.09.18(13) and before, have XSS in the SNMP configuration via the webserv/cplcfg/snmp.ssi SNMP_DESC or SNMP_LOC_SNMP_CONT field.

Affected products

WAGO 750-352 Firmware: before 14 — fixed in 14
WAGO 750-362 Firmware: before 05 — fixed in 05
WAGO 750-363 Firmware: before 05 — fixed in 05
WAGO 750-823 Firmware: before 05 — fixed in 05
WAGO 750-831 Firmware: before 14 — fixed in 14
WAGO 750-832 Firmware: before 05 — fixed in 05
WAGO 750-852 Firmware: before 14 — fixed in 14
WAGO 750-862 Firmware: before 05 — fixed in 05
WAGO 750-880 Firmware: before 14 — fixed in 14
WAGO 750-881 Firmware: before 14 — fixed in 14
WAGO 750-889 Firmware: before 14 — fixed in 14
WAGO 750-890 Firmware: before 05 — fixed in 05
WAGO 750-891 Firmware: before 05 — fixed in 05
Wago 750-881 Ethernet Controller Devices Firmware: 01.08.01(10), 01.09.18(13)

How to fix

Upgrade to a fixed version: WAGO 750-352 Firmware 14; WAGO 750-362 Firmware 05; WAGO 750-363 Firmware 05; WAGO 750-823 Firmware 05; WAGO 750-831 Firmware 14; WAGO 750-832 Firmware 05; WAGO 750-852 Firmware 14; WAGO 750-862 Firmware 05; WAGO 750-880 Firmware 14; WAGO 750-881 Firmware 14; WAGO 750-889 Firmware 14; WAGO 750-890 Firmware 05. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-16210 or the next vulnerability affects your stack