Vulnerabilities in WAGO

98 results
Vexday analysis

Com 64 CVEs catalogadas, o portfólio de vulnerabilidades da WAGO apresenta 20 entradas de severidade crítica — um volume que exige atenção contínua em ambientes de tecnologia operacional. A taxa de exploração ativa está abaixo da média geral do catálogo CISA KEV, com nenhuma CVE confirmada em uso por atores de ameaça no momento, o que oferece uma janela para priorização proativa de remediações. O ponto de maior preocupação imediata é CVE-2023-1698, com escore EPSS de 0,8191, indicando alta probabilidade estatística de exploração — essa falha merece tratamento prioritário independentemente da ausência de registro formal no KEV. O tipo de fraqueza mais recorrente, CWE-306 (ausência de autenticação para função crítica), é especialmente relevante em contextos industriais onde o acesso não autenticado a funções de controle pode ter consequências físicas diretas.

CVE-2023-1698CRITICALWAGO: WBM Command Injection in multiple productsEPSS 82.0%CVE-2019-5155—An exploitable command injection vulnerability exists in the cloud connectivity feature of WAGO PFC200. An attacker can inject operating sysEPSS 4.6%CVE-2019-5157—An exploitable command injection vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 Firmware versions 03.02.02(14),EPSS 4.2%CVE-2019-5156—An exploitable command injection vulnerability exists in the cloud connectivity functionality of WAGO PFC200 versions 03.02.02(14), 03.01.07EPSS 4.2%CVE-2018-8836—Wago 750 Series PLCs with firmware version 10 and prior include a remote attack may take advantage of an improper implementation of the 3 waEPSS 3.6%CVE-2019-10953HIGHABB, Phoenix Contact, Schneider Electric, Siemens, WAGO - Programmable Logic Controllers, multiple versions. Researchers have found some conEPSS 3.4%CVE-2020-12522CRITICALCommand Injection Vulnerability in I/O-Check Service of WAGO PFC100, PFC200 and Touch Panel 600 Series with firmware versions <=FW10EPSS 2.9%CVE-2019-5160—An exploitable improper host validation vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 Firmware versions 03.02.EPSS 2.7%CVE-2019-5161—An exploitable remote code execution vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 versions 03.02.02(14), 03.0EPSS 2.5%CVE-2019-5134—An exploitable regular expression without anchors vulnerability exists in the Web-Based Management (WBM) authentication functionality of WAGEPSS 2.3%CVE-2020-12516HIGHWAGO: PLC families 750-88x and 750-352 prone to DoS attackEPSS 1.9%CVE-2019-5159—An exploitable improper input validation vulnerability exists in the firmware update functionality of WAGO e!COCKPIT automation software v1.EPSS 1.9%CVE-2019-5149—The WBM web application on firmwares prior to 03.02.02 and 03.01.07 on the WAGO PFC100 and PFC2000, respectively, runs on a lighttpd web serEPSS 1.8%CVE-2020-12506CRITICALWAGO: Authentication Bypass Vulnerability in WAGO 750-36X and WAGO 750-8XX Versions <= FW03EPSS 1.5%CVE-2019-5171—An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.0EPSS 1.4%CVE-2019-5175—An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.0EPSS 1.4%CVE-2019-5174—An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 version 03.02.02(14).EPSS 1.4%CVE-2019-5173—An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.0EPSS 1.4%CVE-2019-5170—An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.0EPSS 1.4%CVE-2019-5169—An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.0EPSS 1.4%