Details of VAR-202311-1670

ID

VAR-202311-1670

CVE

CVE-2023-3379

TITLE

plural WAGO Product vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2023-018600

DESCRIPTION

Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker to change the passwords of other non-admin users and thus to escalate non-root privileges. compact controller 100 firmware, Edge Controller firmware, PFC100 firmware etc. WAGO There are unspecified vulnerabilities in the product.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.71

sources: NVD: CVE-2023-3379 // JVNDB: JVNDB-2023-018600 // VULMON: CVE-2023-3379

AFFECTED PRODUCTS

vendor:	wago	model:	pfc100	scope:	lt	version:	22	Trust: 1.0
vendor:	wago	model:	pfc200	scope:	eq	version:	22	Trust: 1.0
vendor:	wago	model:	pfc200	scope:	lt	version:	22	Trust: 1.0
vendor:	wago	model:	pfc200	scope:	eq	version:	24	Trust: 1.0
vendor:	wago	model:	touch panel 600 advanced	scope:	lte	version:	25	Trust: 1.0
vendor:	wago	model:	pfc100	scope:	eq	version:	22	Trust: 1.0
vendor:	wago	model:	touch panel 600 marine	scope:	lte	version:	25	Trust: 1.0
vendor:	wago	model:	compact controller 100	scope:	lte	version:	25	Trust: 1.0
vendor:	wago	model:	edge controller	scope:	lte	version:	25	Trust: 1.0
vendor:	wago	model:	touch panel 600 standard	scope:	lte	version:	25	Trust: 1.0
vendor:	wago	model:	pfc200	scope:	eq	version:	23	Trust: 1.0
vendor:	wago	model:	touch panel 600 marine	scope:	-	version:	-	Trust: 0.8
vendor:	wago	model:	touch panel 600 standard	scope:	-	version:	-	Trust: 0.8
vendor:	wago	model:	edge controller	scope:	-	version:	-	Trust: 0.8
vendor:	wago	model:	pfc100	scope:	-	version:	-	Trust: 0.8
vendor:	wago	model:	pfc200	scope:	-	version:	-	Trust: 0.8
vendor:	wago	model:	touch panel 600 advanced	scope:	-	version:	-	Trust: 0.8
vendor:	wago	model:	compact controller 100	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2023-018600 // NVD: CVE-2023-3379

CVSS

SEVERITY

CVSSV2

CVSSV3

info@cert.vde.com:	CVE-2023-3379
value:	MEDIUM
Trust: 1.0
OTHER:	JVNDB-2023-018600
value:	MEDIUM
Trust: 0.8

info@cert.vde.com:	CVE-2023-3379
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	LOW
exploitabilityScore:	1.8
impactScore:	3.4
version:	3.1
Trust: 1.0
OTHER:	JVNDB-2023-018600
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	LOW
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2023-018600 // NVD: CVE-2023-3379

PROBLEMTYPE DATA

problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	CWE-863	Trust: 1.0
problemtype:	Lack of information (CWE-noinfo) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2023-018600 // NVD: CVE-2023-3379

EXTERNAL IDS

db:	NVD	id:	CVE-2023-3379	Trust: 2.7
db:	CERT@VDE	id:	VDE-2023-015	Trust: 1.9
db:	JVNDB	id:	JVNDB-2023-018600	Trust: 0.8
db:	VULMON	id:	CVE-2023-3379	Trust: 0.1

sources: VULMON: CVE-2023-3379 // JVNDB: JVNDB-2023-018600 // NVD: CVE-2023-3379

REFERENCES

url:	https://cert.vde.com/en/advisories/vde-2023-015/	Trust: 1.9
url:	https://nvd.nist.gov/vuln/detail/cve-2023-3379	Trust: 0.8
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULMON: CVE-2023-3379 // JVNDB: JVNDB-2023-018600 // NVD: CVE-2023-3379

SOURCES

db:	VULMON	id:	CVE-2023-3379
db:	JVNDB	id:	JVNDB-2023-018600
db:	NVD	id:	CVE-2023-3379

LAST UPDATE DATE

2024-10-02T23:21:20.711000+00:00

SOURCES UPDATE DATE

db:	VULMON	id:	CVE-2023-3379	date:	2023-11-20T00:00:00
db:	JVNDB	id:	JVNDB-2023-018600	date:	2024-01-11T07:25:00
db:	NVD	id:	CVE-2023-3379	date:	2024-10-02T06:15:08.453

SOURCES RELEASE DATE

db:	VULMON	id:	CVE-2023-3379	date:	2023-11-20T00:00:00
db:	JVNDB	id:	JVNDB-2023-018600	date:	2024-01-11T00:00:00
db:	NVD	id:	CVE-2023-3379	date:	2023-11-20T08:15:44.280