CVE-2022-3738CWE-306

WAGO: Missing authentication for config export functionality in multiple products

Medium · published January 19, 2023

CVSS v3.1
5.9
EPSS
1%
Percentile
49.3
In the wild
Unconfirmed
What it is

The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like credentials and cryptographic material. A valid user has to create a backup after the last reboot for this attack to be successfull.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00625 · 49.3th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2023-01-19T11:27Z
EPSS history
Timeline
  • 19 JAN 11:27Z
    WAGO: Missing authentication for config export functionality in multiple products
    cvelistv5