CVE-2020-12506 — Missing Authentication for Critical Function in 750-362

CWE-306 — Missing Authentication for Critical Function3 documents3 sources
Severity
9.1CRITICALNVD
EPSS
0.3%
top 49.54%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
14
Wago 750-362Wago 750-363Wago 750-823+11 more
Timeline
PublishedSep 30
Latest updateMay 24

Description

Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW03 allows an attacker to change the settings of the devices by sending specifically constructed requests without authentication This issue affects: WAGO 750-362, WAGO 750-363, WAGO 750-823, WAGO 750-832/xxx-xxx, WAGO 750-862, WAGO 750-891, WAGO 750-890/xxx-xxx in versions FW03 and prior versions.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HExploitability: 3.9 | Impact: 5.2

Affected Packages14 packages

▶CVEListV5wago/750-362unspecified — FW03
▶CVEListV5wago/750-363unspecified — FW03
▶CVEListV5wago/750-823unspecified — FW03
▶CVEListV5wago/750-862unspecified — FW03
▶CVEListV5wago/750-891unspecified — FW03

🔴Vulnerability Details

2
GHSA
GHSA-8c2w-ph9m-jcmf: Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW03 allows an attacker to change the settings of the devices by sendi↗2022-05-24
▶
CVEList
WAGO: Authentication Bypass Vulnerability in WAGO 750-36X and WAGO 750-8XX Versions <= FW03↗2020-09-30
▶
CVE-2020-12506 — Wago 750-362 vulnerability | cvebase