CVE-2022-45138WAGO: Missing Authentication for Critical Function
- 9.8CriticalCVSS base score
- 0.74%Exploitation in 30 daysEPSS · top 45% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API. The vulnerability allows an unauthenticated attacker to read and set several device parameters that can lead to full compromise of the device.
Timeline
ID reserved
By CERTVDE
- 4 months later
· 4 months later
Published
- 2 years later
· 2 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CERTVDECNA (assigner) | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.74% · top 45% of all CVEs (12 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Affected products
WAGO · Compact Controller CC100 (751-9301)
- affected FW16 – < FW22
- unaffected FW22 Patch 1
- affected FW23
WAGO · Edge Controller (752-8303/8000-002)
- affected FW18 – < FW22
- unaffected FW22 Patch 1
- affected FW23
WAGO · PFC100 (750-81xx/xxx-xxx)
- affected FW16 – < FW22
- unaffected FW22 Patch 1
- affected FW23
WAGO · PFC200 (750-82xx/xxx-xxx)
- affected FW16 – < FW22
- unaffected FW22 Patch 1
- affected FW23
WAGO · Touch Panel 600 Advanced Line (762-5xxx)
- affected FW16 – < FW22
- unaffected FW22 Patch 1
- affected FW23
WAGO · Touch Panel 600 Marine Line (762-6xxx)
- affected FW16 – < FW22
- unaffected FW22 Patch 1
- affected FW23
WAGO · Touch Panel 600 Standard Line (762-4xxx)
- affected FW16 – < FW22
- unaffected FW22 Patch 1
- affected FW23
References
References1
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2022-48053 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2022-45138)Record last updated .