VulnerabilityModified
CVE-2023-4149
A vulnerability in the web-based management allows an unauthenticated remote attacker to inject arbitrary system commands and gain full system control.
CRITICAL 9.8EPSS 1.12%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.12%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A vulnerability in the web-based management allows an unauthenticated remote attacker to inject arbitrary system commands and gain full system control. Those commands are executed with root privileges. The vulnerability is located in the user request handling of the web-based management.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.12% probability · 64th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Affected
- wago/0852-0602 firmware · wago/0852-0603 firmware · wago/0852-1605 firmware
- Source
- info@cert.vde.com
References
- https://cert.vde.com/en/advisories/VDE-2023-037Third Party Advisory
- https://cert.vde.com/en/advisories/VDE-2023-037Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.