CVE Feed

    Dashboard / CVE / CVE-2016-9362

    CVE-2016-9362

    An issue was discovered in WAGO 750-8202/PFC200 prior to FW04 (released August 2015), WAGO 750-881 prior to FW09 (released August 2016), and WAGO 0758-0874-0000-0111. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to edit and to view settings without authenticating.

    Published:Feb 13, 2017
    Last Modified:Apr 20, 2025
    EPS:Feb 13, 2017
    EPSS Score:0.00206
    CVSS Score:9.1

    Affected Products

    Vendor
    Wago
    Product
    750-8202
    Vendor
    Wago
    Product
    750-881
    Vendor
    Wago
    Product
    750-xxxx Series Firmware
    Vendor
    Wago
    Product
    758-874-0000-0111
    Vendor
    Wago
    Product
    758-xxxx Series Firmware
    Vendor
    Wago
    Product
    Pfc200
    Vendor
    Wago
    Product
    Pfc200 Firmware

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-287 Improper Authentication

    Related CVEs

    CVE-2023-1620 (CVSS 4.9) — Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to …
    CVE-2023-1619 (CVSS 4.9) — Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to …
    CVE-2020-12069 (CVSS 7.8) — In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime …
    CVE-2021-34569 (CVSS 9.8) — In WAGO I/O-Check Service in multiple products an attacker can send a specially crafted packet containing OS c…
    CVE-2021-34568 (CVSS 7.5) — In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted…
    CVE-2021-34567 (CVSS 8.2) — In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted…
    CVE-2021-34566 (CVSS 9.1) — In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted…
    CVE-2022-22511 (CVSS 5.4) — Various configuration pages of the device are vulnerable to reflected XSS (Cross-Site Scripting) attacks. An a…
    CVE-2021-34596 (CVSS 6.5) — A crafted request may cause a read access to an uninitialized pointer in CODESYS V2 Runtime Toolkit 32 Bit ful…
    CVE-2021-34595 (CVSS 8.1) — A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime T…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High