CVE-2024-41970

WAGO: Unauthorized Diagnostic Data Exposure in Multiple Devices

Published Nov 18, 2024 CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Description

A low privileged remote attacker may gain access to forbidden diagnostic data due to incorrect permission assignment for critical resources.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

WAGO

CC100 0751-9x01

unaffected

Version	Status	Constraints
`0.0.0`	affected	≤ 4.5.10 (FW27)

WAGO

PFC100 G2 0750-811x-xxxx-xxxx

unaffected

Version	Status	Constraints
`0.0.0`	affected	≤ 4.5.10 (FW27)

WAGO

PFC200 G2 750-821x-xxx-xxx

unaffected

Version	Status	Constraints
`0.0.0`	affected	≤ 4.5.10 (FW27)

WAGO

TP600 0762-420x/8000-000x

unaffected

Version	Status	Constraints
`0.0.0`	affected	≤ 4.5.10 (FW27)

WAGO

TP600 0762-430x/8000-000x

unaffected

Version	Status	Constraints
`0.0.0`	affected	≤ 4.5.10 (FW27)

WAGO

TP600 0762-520x/8000-000x

unaffected

Version	Status	Constraints
`0.0.0`	affected	≤ 4.5.10 (FW27)

WAGO

TP600 0762-530x/8000-000x

unaffected

Version	Status	Constraints
`0.0.0`	affected	≤ 4.5.10 (FW27)

WAGO

TP600 0762-620x/8000-000x

unaffected

Version	Status	Constraints
`0.0.0`	affected	≤ 4.5.10 (FW27)

WAGO

TP600 0762-630x/8000-000x

unaffected

Version	Status	Constraints
`0.0.0`	affected	≤ 4.5.10 (FW27)

WAGO

Edge Controller 0752-8303/8000-0002

unaffected

Version	Status	Constraints
`0.0.0`	affected	≤ 4.5.10 (FW27)

WAGO

PFC200 G2 0750-821x/xxx-xxx

unaffected

Version	Status	Constraints
`0.0.0`	affected	≤ 04.04.03 (70)

WAGO

CC100 0751/9x01

unaffected

Version	Status	Constraints
`0.0.0`	affected	≤ 04.03.03 (72)

WAGO

CC100 0751/9x01

unaffected

Version	Status	Constraints
`0.0.0`	affected	≤ 04.04.03 (70)

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2024-39300	A low privileged remote attacker may gain access to forbidden diagnostic data due to incorrect permission assignment for critical resources.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.364% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://cert.vde.com/en/advisories/VDE-2024-047

History

Nov 18, 2024 4:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Nov 18, 2024 9:30 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A low privileged remote attacker may gain access to forbidden diagnostic data due to incorrect permission assignment for critical resources.
Title		WAGO: Unauthorized Diagnostic Data Exposure in Multiple Devices
Weaknesses		CWE-732
References		https://cert.vde.com/en/advisories/VDE-2024-047
Metrics		cvssV3_1 `{'score': 5.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N'}`