CVE-2023-4149

A vulnerability in the web-based management allows an unauthenticated remote attacker to inject arbitrary system commands and gain full system control. Those commands are executed with root privileges. The vulnerability is located in the user request handling of the web-based management.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://cert.vde.com/en/advisories/VDE-2023-037	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:wago:0852-0602_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:wago:0852-0602:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:wago:0852-0603_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:wago:0852-0603:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:wago:0852-1605_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:wago:0852-1605:-:*:*:*:*:*:*:*

History

29 Nov 2023, 17:09

Type	Values Removed	Values Added
First Time		Wago 0852-0603 Firmware Wago 0852-0603 Wago 0852-0602 Wago Wago 0852-1605 Wago 0852-1605 Firmware Wago 0852-0602 Firmware
CPE		cpe:2.3:o:wago:0852-0603_firmware:::::::: cpe:2.3:h:wago:0852-1605:-:::::::* cpe:2.3:h:wago:0852-0603:-:::::::* cpe:2.3:o:wago:0852-0602_firmware:::::::: cpe:2.3:o:wago:0852-1605_firmware:::::::: cpe:2.3:h:wago:0852-0602:-:::::::*
References	~~() https://cert.vde.com/en/advisories/VDE-2023-037 -~~	() https://cert.vde.com/en/advisories/VDE-2023-037 - Third Party Advisory

21 Nov 2023, 07:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-11-21 07:15

Updated : 2023-12-10 15:26

NVD link : CVE-2023-4149

Mitre link : CVE-2023-4149

CVE.ORG link : CVE-2023-4149

JSON object : View

Products Affected

wago

0852-0603
0852-1605
0852-0602_firmware
0852-0603_firmware
0852-1605_firmware
0852-0602

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2023-4149", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "info@cert.vde.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2023-11-21T07:15:10.093", "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2023-037", "tags": ["Third Party Advisory"], "source": "info@cert.vde.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "info@cert.vde.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the web-based management allows an unauthenticated remote attacker to inject arbitrary system commands and gain full system control. Those commands are executed with root privileges. The vulnerability is located in the user request handling of the web-based management."}, {"lang": "es", "value": "Una vulnerabilidad en la administraci\u00f3n basada en web permite a un atacante remoto no autenticado inyectar comandos arbitrarios del sistema y obtener control total del sistema. Esos comandos se ejecutan con privilegios de root. La vulnerabilidad se encuentra en el manejo de solicitudes de usuario de la administraci\u00f3n basada en web."}], "lastModified": "2023-11-29T17:09:20.563", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:wago:0852-0602_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1E566DF8-4C11-477B-A3BA-760ED872B25B", "versionEndExcluding": "1.0.6.s0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:wago:0852-0602:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F8F7F63C-9E81-496F-ACB9-813588092E70"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:wago:0852-0603_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "00934DAB-5B90-42F5-B31C-BCF4563D55D0", "versionEndExcluding": "1.0.6.s0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:wago:0852-0603:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2F4983F7-80F3-499D-AE4C-500EACAE2116"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:wago:0852-1605_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6507316E-3396-4E54-BA71-AA7BDD673D29", "versionEndExcluding": "1.2.5.s0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:wago:0852-1605:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "946F6CAD-36DF-4D46-96AE-E69C8DFC30F7"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "info@cert.vde.com"}