What’s Vulnerable › Vulnerabilities

CVE-2022-3738: WAGO: Missing authentication for config export functionality in multiple products

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-01-19 · updated 2026-06-17
• Weakness: CWE-306

Description

The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like credentials and cryptographic material. A valid user has to create a backup after the last reboot for this attack to be successfull.

Affected products

• WAGO Cc100 Firmware: from 16 through 22
• WAGO Edge Controller Firmware: from 16 through 22
• WAGO Pfc100 Firmware: from 16 through 22
• WAGO PFC200: from 16 through 22
• WAGO Touch Panel 600 Advanced Firmware: from 16 through 22
• WAGO Touch Panel 600 Marine Firmware: from 16 through 22
• WAGO Touch Panel 600 Standard Firmware: from 16 through 22

References

• https://cert.vde.com/en/advisories/VDE-2022-054/
• https://cert.vde.com/en/advisories/VDE-2022-054/

Get alerted when CVE-2022-3738 or the next vulnerability affects your stack