CVE-2022-3843 WAGO: Exposure of configuration interface in unmanaged switches
Remote attackers can access an undocumented configuration interface on WAGO unmanaged switches to read system information and modify limited parameters without authorization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-3843?
CVE-2022-3843 is a critical missing authorization vulnerability in WAGO Unmanaged Switch 852-111/000-001, published on 16 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In WAGO Unmanaged Switch (852-111/000-001) in firmware version 01 an undocumented configuration interface without authorization allows an remote attacker to read system information and configure a limited set of parameters.
Weakness: CWE-912
Which versions are affected by CVE-2022-3843?
It affects 1 product.
Products include Wago 852-111\/000-001 Firmware.
How do I fix CVE-2022-3843?
No fix has been published for CVE-2022-3843 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-3843 being exploited?
There is no known exploitation of CVE-2022-3843 in the wild and no public exploit code.
Sources
Also known as GHSA-xvpp-hhff-gp7v.