750-81xx/xxx-xxx Series PFC100/PFC200: Expected Behavior Violation
CVE-2022-3281 is a high-severity expected behavior violation vulnerability in 750-81xx/xxx-xxx Series PFC100/PFC200 from WAGO, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected 750-81xx/xxx-xxx Series PFC100/PFC200 versions: 03.01.07(13) through 03.10.08(22). The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.81% chance of exploitation within 30 days, higher than 57% of scored CVEs.
High severity with no evidence of exploitation so far.
What to do
- Check which version of 750-81xx/xxx-xxx Series PFC100/PFC200 you run against the affected versions below, and install the vendor's latest release.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| WAGO | 750-81xx/xxx-xxx Series PFC100/PFC200 | 03.01.07(13) through 03.10.08(22) | Not stated |
| WAGO | 750-8217/xxx-xxx Series PFC100/PFC200 | 03.04.10(16) through 03.10.08(22) | Not stated |
| WAGO | 750-82xx/xxx-xxx Series PFC100/PFC200 | 03.01.07(13) through 03.10.08(22) | Not stated |
| WAGO | Compact Controller CC100 | 03.07.17(19) through 03.09.08(21) | Not stated |
| WAGO | 762-4xxx Series Touch Panel 600 | 03.01.07(13) through 03.10.09(22) | Not stated |
| WAGO | 762-5xxx Series Touch Panel 600 | 03.01.07(13) through 03.10.09(22) | Not stated |
| WAGO | 762-6xxx Series Touch Panel 600 | 03.01.07(13) through 03.10.09(22) | Not stated |
| WAGO | 752-8303/8000-002 Edge Controller | 03.06.09(18) through 03.10.09(22) | Not stated |
| Wago | 750-8100 Firmware | 03.01.07\(13\) through 03.10.08\(22\) | Not stated |
| Wago | 750-8101 Firmware | 03.01.07\(13\) through 03.10.08\(22\) | Not stated |
| Wago | 750-8101/000-010 Firmware | 03.01.07\(13\) through 03.10.08\(22\) | Not stated |
| Wago | 750-8101/025-000 Firmware | 03.01.07\(13\) through 03.10.08\(22\) | Not stated |
| Wago | 750-8102 Firmware | 03.01.07\(13\) through 03.10.08\(22\) | Not stated |
| Wago | 750-8102/025-000 Firmware | 03.01.07\(13\) through 03.10.08\(22\) | Not stated |
| Wago | 750-8202/000-011 Firmware | 03.01.07\(13\) through 03.10.08\(22\) | Not stated |
| Wago | 750-8202/000-012 Firmware | 03.01.07\(13\) through 03.10.08\(22\) | Not stated |
| Wago | 750-8202/000-022 Firmware | 03.01.07\(13\) through 03.10.08\(22\) | Not stated |
| Wago | 750-8206 Firmware | 03.01.07\(13\) through 03.10.08\(22\) | Not stated |
| Wago | 750-8206/025-000 Firmware | 03.01.07\(13\) through 03.10.08\(22\) | Not stated |
| Wago | 750-8206/025-001 Firmware | 03.01.07\(13\) through 03.10.08\(22\) | Not stated |
| Wago | 750-8207 Firmware | 03.01.07\(13\) through 03.10.08\(22\) | Not stated |
| Wago | 750-8207/025-000 Firmware | 03.01.07\(13\) through 03.10.08\(22\) | Not stated |
| Wago | 750-8207/025-001 Firmware | 03.01.07\(13\) through 03.10.08\(22\) | Not stated |
| Wago | 750-8208 Firmware | 03.01.07\(13\) through 03.10.08\(22\) | Not stated |
| Wago | 750-8208/025-000 Firmware | 03.01.07\(13\) through 03.10.08\(22\) | Not stated |
Version data comes from the organisation that assigned the CVE; 35 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- NoneNo data is disclosed.
- Integrity
- HighData or code can be modified at will.
- Availability
- NoneAvailability is not affected.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 7.5 | High | CNA (cert.vde.com) |
| CVSS 3.1 | 7.5 | High | NVD |
Official description
WAGO Series PFC100/PFC200, Series Touch Panel 600, Compact Controller CC100 and Edge Controller in multiple versions are prone to a loss of MAC-Address-Filtering after reboot. This may allow an remote attacker to circumvent the reach the network that should be protected by the MAC address filter.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Expected Behavior Violation
A feature, API, or function does not perform according to its specification.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- cert.vde.com/en/advisories/VDE-2022-042/Mitigation, Third Party Advisory
Spotted an error? Tell us.