CVE-2023-4149: A vulnerability in the web-based management allows an unauthenticated remote attacker to inject arbitrary system commands and gain full system control. Those…

PriorityP266critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

1.12%

62.0th percentile

A vulnerability in the web-based management allows an unauthenticated remote attacker to inject arbitrary system commands and gain full system control. Those commands are executed with root privileges. The vulnerability is located in the user request handling of the web-based management.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
wago	0852-0602_firmware	< 1.0.6.s0	1.0.6.s0
wago	0852-0603_firmware	< 1.0.6.s0	1.0.6.s0
wago	0852-1605_firmware	< 1.2.5.s0	1.2.5.s0
wago	industrial_managed_switch	< 1.0.6.S0	1.0.6.S0
wago	industrial_managed_switch	< 1.2.5.S0	1.2.5.S0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.