CVE-2022-22511: WAGO PLCs WBM vulnerable to reflected XSS

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-03-09 · updated 2026-06-17
Weakness: CWE-79

Description

Various configuration pages of the device are vulnerable to reflected XSS (Cross-Site Scripting) attacks. An authorized attacker with user privileges may use this to gain access to confidential information on a PC that connects to the WBM after it has been compromised.

Affected products

WAGO 750-8100 Firmware: from fw16 before fw22 — fixed in fw22
WAGO 750-8101/025-000 Firmware: from fw16 before fw22 — fixed in fw22
WAGO 750-8101 Firmware: from fw16 before fw22 — fixed in fw22
WAGO 750-8102/025-000 Firmware: from fw16 before fw22 — fixed in fw22
WAGO 750-8102 Firmware: from fw16 before fw22 — fixed in fw22
WAGO 750-8202/000-012 Firmware: from fw16 before fw22 — fixed in fw22
WAGO 750-8202/000-022 Firmware: from fw16 before fw22 — fixed in fw22
WAGO 750-8202/025-000 Firmware: from fw16 before fw22 — fixed in fw22
WAGO 750-8202/025-001 Firmware: from fw16 before fw22 — fixed in fw22
WAGO 750-8202 Firmware: from fw16 before fw22 — fixed in fw22
WAGO 750-82 Firmware: from fw16 before fw22 — fixed in fw22
WAGO 751-9301 Firmware: from fw16 before fw22 — fixed in fw22
WAGO 752-8303/8000-002 Firmware: from fw16 before fw22 — fixed in fw22
WAGO 762-4205/8000-002 Firmware: from fw16 before fw22 — fixed in fw22
WAGO 762-4206/8000-002 Firmware: from fw16 before fw22 — fixed in fw22
WAGO 762-4305/8000-002 Firmware: from fw16 before fw22 — fixed in fw22
WAGO 762-4306/8000-002 Firmware: from fw16 before fw22 — fixed in fw22
WAGO 762-5205/8000-001 Firmware: from fw16 before fw22 — fixed in fw22
WAGO 762-5206/8000-001 Firmware: from fw16 before fw22 — fixed in fw22
WAGO 762-5305/8000-002 Firmware: from fw16 before fw22 — fixed in fw22
WAGO 762-5306/8000-002 Firmware: from fw16 before fw22 — fixed in fw22
WAGO 762-6301/8000-002 Firmware: from fw16 before fw22 — fixed in fw22
WAGO 762-6302/8000-002 Firmware: from fw16 before fw22 — fixed in fw22
WAGO 762-6303/8000-002 Firmware: from fw16 before fw22 — fixed in fw22
WAGO 762-6304/8000-002 Firmware: from fw16 before fw22 — fixed in fw22

How to fix

Upgrade to a fixed version: WAGO 750-8100 Firmware fw22; WAGO 750-8101/025-000 Firmware fw22; WAGO 750-8101 Firmware fw22; WAGO 750-8102/025-000 Firmware fw22; WAGO 750-8102 Firmware fw22; WAGO 750-8202/000-012 Firmware fw22; WAGO 750-8202/000-022 Firmware fw22; WAGO 750-8202/025-000 Firmware fw22; WAGO 750-8202/025-001 Firmware fw22; WAGO 750-8202 Firmware fw22; WAGO 750-82 Firmware fw22; WAGO 751-9301 Firmware fw22. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-22511 or the next vulnerability affects your stack