Sign-up

ID

VAR-202301-1424


CVE

CVE-2022-3738


TITLE

plural  WAGO  Vulnerability related to lack of authentication for critical functions in the product

Trust: 0.8

sources: JVNDB: JVNDB-2023-001947

DESCRIPTION

The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like credentials and cryptographic material. A valid user has to create a backup after the last reboot for this attack to be successfull. plural WAGO The product contains a lack of authentication vulnerability for critical functionality.Information may be obtained

Trust: 1.71

sources: NVD: CVE-2022-3738 // JVNDB: JVNDB-2023-001947 // VULMON: CVE-2022-3738

AFFECTED PRODUCTS

vendor:wagomodel:cc100scope:lteversion:22

Trust: 1.0

vendor:wagomodel:touch panel 600 advancedscope:gteversion:16

Trust: 1.0

vendor:wagomodel:pfc100scope:lteversion:22

Trust: 1.0

vendor:wagomodel:pfc200scope:gteversion:16

Trust: 1.0

vendor:wagomodel:edge controllerscope:lteversion:22

Trust: 1.0

vendor:wagomodel:touch panel 600 standardscope:gteversion:16

Trust: 1.0

vendor:wagomodel:pfc200scope:lteversion:22

Trust: 1.0

vendor:wagomodel:edge controllerscope:gteversion:16

Trust: 1.0

vendor:wagomodel:touch panel 600 standardscope:lteversion:22

Trust: 1.0

vendor:wagomodel:touch panel 600 marinescope:lteversion:22

Trust: 1.0

vendor:wagomodel:cc100scope:gteversion:16

Trust: 1.0

vendor:wagomodel:pfc100scope:gteversion:16

Trust: 1.0

vendor:wagomodel:touch panel 600 advancedscope:lteversion:22

Trust: 1.0

vendor:wagomodel:touch panel 600 marinescope:gteversion:16

Trust: 1.0

vendor:ワゴジャパン株式会社model:touch panel 600 standardscope: - version: -

Trust: 0.8

vendor:ワゴジャパン株式会社model:pfc100scope: - version: -

Trust: 0.8

vendor:ワゴジャパン株式会社model:touch panel 600 advancedscope: - version: -

Trust: 0.8

vendor:ワゴジャパン株式会社model:compact controller cc100scope: - version: -

Trust: 0.8

vendor:ワゴジャパン株式会社model:edge controllerscope: - version: -

Trust: 0.8

vendor:ワゴジャパン株式会社model:touch panel 600 marinescope: - version: -

Trust: 0.8

vendor:ワゴジャパン株式会社model:pfc200scope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2023-001947 // NVD: CVE-2022-3738

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2022-3738
value: MEDIUM

Trust: 1.8

info@cert.vde.com: CVE-2022-3738
value: MEDIUM

Trust: 1.0

CNNVD: CNNVD-202301-1507
value: MEDIUM

Trust: 0.6

NVD:
baseSeverity: MEDIUM
baseScore: 5.9
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 2.2
impactScore: 3.6
version: 3.1

Trust: 2.0

NVD: CVE-2022-3738
baseSeverity: MEDIUM
baseScore: 5.9
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2023-001947 // NVD: CVE-2022-3738 // NVD: CVE-2022-3738 // CNNVD: CNNVD-202301-1507

PROBLEMTYPE DATA

problemtype:CWE-306

Trust: 1.0

problemtype:Lack of authentication for critical features (CWE-306) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2023-001947 // NVD: CVE-2022-3738

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202301-1507

TYPE

access control error

Trust: 0.6

sources: CNNVD: CNNVD-202301-1507

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2022-3738

PATCH
title:Top Pageurl:https://www.wago.com/us/
Trust: 0.8
title:WAGO Fixes for access control error vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqbyid.tag?id=222117
Trust: 0.6
title: - url:https://github.com/live-hack-cve/cve-2022-3738 
Trust: 0.1
sources:
            
            
            VULMON: CVE-2022-3738 // 
            
            
            
            JVNDB: JVNDB-2023-001947 // 
            
            
            
            CNNVD: CNNVD-202301-1507

EXTERNAL IDS
db:NVDid:CVE-2022-3738
Trust: 3.3
db:CERT@VDEid:VDE-2022-054
Trust: 2.5
db:JVNDBid:JVNDB-2023-001947
Trust: 0.8
db:CNNVDid:CNNVD-202301-1507
Trust: 0.6
db:VULMONid:CVE-2022-3738
Trust: 0.1
sources:
            
            
            VULMON: CVE-2022-3738 // 
            
            
            
            JVNDB: JVNDB-2023-001947 // 
            
            
            
            NVD: CVE-2022-3738 // 
            
            
            
            CNNVD: CNNVD-202301-1507

REFERENCES
url:https://cert.vde.com/en/advisories/vde-2022-054/
Trust: 2.5
url:https://nvd.nist.gov/vuln/detail/cve-2022-3738
Trust: 0.8
url:https://cxsecurity.com/cveshow/cve-2022-3738/
Trust: 0.6
url:https://cwe.mitre.org/data/definitions/306.html
Trust: 0.1
url:https://github.com/live-hack-cve/cve-2022-3738
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            VULMON: CVE-2022-3738 // 
            
            
            
            JVNDB: JVNDB-2023-001947 // 
            
            
            
            NVD: CVE-2022-3738 // 
            
            
            
            CNNVD: CNNVD-202301-1507

SOURCES
db:VULMONid:CVE-2022-3738
db:JVNDBid:JVNDB-2023-001947
db:NVDid:CVE-2022-3738
db:CNNVDid:CNNVD-202301-1507

LAST UPDATE DATE
2023-12-18T12:15:03.973000+00:00

SOURCES UPDATE DATE
db:VULMONid:CVE-2022-3738date:2023-01-19T00:00:00
db:JVNDBid:JVNDB-2023-001947date:2023-05-25T06:27:00
db:NVDid:CVE-2022-3738date:2023-11-07T10:15:07.787
db:CNNVDid:CNNVD-202301-1507date:2023-01-28T00:00:00

SOURCES RELEASE DATE
db:VULMONid:CVE-2022-3738date:2023-01-19T00:00:00
db:JVNDBid:JVNDB-2023-001947date:2023-05-25T00:00:00
db:NVDid:CVE-2022-3738date:2023-01-19T12:15:11.213
db:CNNVDid:CNNVD-202301-1507date:2023-01-19T00:00:00