Details of VAR-202305-1415

ID

VAR-202305-1415

CVE

CVE-2023-1698

TITLE

plural WAGO In the product OS Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2023-009971

DESCRIPTION

In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behaviour, Denial of Service and full system compromise. compact controller 100 firmware, Edge Controller firmware, PFC100 firmware etc. WAGO The product has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.71

sources: NVD: CVE-2023-1698 // JVNDB: JVNDB-2023-009971 // VULMON: CVE-2023-1698

AFFECTED PRODUCTS

vendor:	wago	model:	edge controller	scope:	eq	version:	22	Trust: 1.0
vendor:	wago	model:	touch panel 600 marine	scope:	eq	version:	22	Trust: 1.0
vendor:	wago	model:	pfc100	scope:	lte	version:	23	Trust: 1.0
vendor:	wago	model:	touch panel 600 advanced	scope:	eq	version:	22	Trust: 1.0
vendor:	wago	model:	compact controller 100	scope:	gte	version:	20	Trust: 1.0
vendor:	wago	model:	compact controller 100	scope:	lte	version:	23	Trust: 1.0
vendor:	wago	model:	pfc100	scope:	gte	version:	20	Trust: 1.0
vendor:	wago	model:	touch panel 600 standard	scope:	eq	version:	22	Trust: 1.0
vendor:	wago	model:	pfc200	scope:	gte	version:	20	Trust: 1.0
vendor:	wago	model:	pfc200	scope:	lte	version:	23	Trust: 1.0
vendor:	wago	model:	compact controller 100	scope:	-	version:	-	Trust: 0.8
vendor:	wago	model:	touch panel 600 marine	scope:	-	version:	-	Trust: 0.8
vendor:	wago	model:	pfc200	scope:	-	version:	-	Trust: 0.8
vendor:	wago	model:	edge controller	scope:	-	version:	-	Trust: 0.8
vendor:	wago	model:	pfc100	scope:	-	version:	-	Trust: 0.8
vendor:	wago	model:	touch panel 600 standard	scope:	-	version:	-	Trust: 0.8
vendor:	wago	model:	touch panel 600 advanced	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2023-009971 // NVD: CVE-2023-1698

CVSS

SEVERITY

CVSSV2

CVSSV3

info@cert.vde.com:	CVE-2023-1698
value:	CRITICAL
Trust: 1.0
OTHER:	JVNDB-2023-009971
value:	CRITICAL
Trust: 0.8

info@cert.vde.com:	CVE-2023-1698
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0
OTHER:	JVNDB-2023-009971
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2023-009971 // NVD: CVE-2023-1698

PROBLEMTYPE DATA

problemtype:	CWE-78	Trust: 1.0
problemtype:	OS Command injection (CWE-78) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2023-009971 // NVD: CVE-2023-1698

EXTERNAL IDS

db:	NVD	id:	CVE-2023-1698	Trust: 2.7
db:	CERT@VDE	id:	VDE-2023-007	Trust: 1.9
db:	JVNDB	id:	JVNDB-2023-009971	Trust: 0.8
db:	VULMON	id:	CVE-2023-1698	Trust: 0.1

sources: VULMON: CVE-2023-1698 // JVNDB: JVNDB-2023-009971 // NVD: CVE-2023-1698

REFERENCES

url:	https://cert.vde.com/en/advisories/vde-2023-007/	Trust: 1.9
url:	https://nvd.nist.gov/vuln/detail/cve-2023-1698	Trust: 0.8
url:	https://cwe.mitre.org/data/definitions/78.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULMON: CVE-2023-1698 // JVNDB: JVNDB-2023-009971 // NVD: CVE-2023-1698

SOURCES

db:	VULMON	id:	CVE-2023-1698
db:	JVNDB	id:	JVNDB-2023-009971
db:	NVD	id:	CVE-2023-1698

LAST UPDATE DATE

2024-08-14T14:54:47.011000+00:00

SOURCES UPDATE DATE

db:	VULMON	id:	CVE-2023-1698	date:	2023-05-15T00:00:00
db:	JVNDB	id:	JVNDB-2023-009971	date:	2023-12-07T05:39:00
db:	NVD	id:	CVE-2023-1698	date:	2023-05-26T17:09:45.837

SOURCES RELEASE DATE

db:	VULMON	id:	CVE-2023-1698	date:	2023-05-15T00:00:00
db:	JVNDB	id:	JVNDB-2023-009971	date:	2023-12-07T00:00:00
db:	NVD	id:	CVE-2023-1698	date:	2023-05-15T09:15:09.510