vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2022-45137

WAGO: Reflective Cross-Site Scripting

MEDIUM
6.1
CVSS Score
Published: February 27, 2023 at 02:36 PM UTC
Updated: June 17, 2026 at 05:09 AM UTC
16 products affected across 1 vendorPFC200 FirmwarePFC100 Firmware752-8303 /8000-002 Firmware

Using Compact Controller CC100 (751-9301) by WAGO?

Get instant alerts when new vulnerabilities affect Compact Controller CC100 (751-9301) - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM6.1
Exploit prediction
EPSS 0.4%

Description

The configuration backend of the web-based management is vulnerable to reflected XSS (Cross-Site Scripting) attacks that targets the users browser. This leads to a limited impact of confidentiality and integrity but no impact of availability.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

751-9301 Firmware· WAGO
95%
16 ≤ v < 222223
Affected range stops below 22, so it looks safe — our inference, not a vendor statement
wago-751-9301 (same device)
752-8303 /8000-002 Firmware· WAGO
95%
18 ≤ v < 222223
Affected range stops below 22, so it looks safe — our inference, not a vendor statement
wago-752-8303-8000-002 (same device)
PFC100 Firmware· WAGO
95%
16 ≤ v < 222223
Affected range stops below 22, so it looks safe — our inference, not a vendor statement
wago-pfc100 (same device)
PFC200 Firmware· WAGO
95%
16 ≤ v < 222223
Affected range stops below 22, so it looks safe — our inference, not a vendor statement
wago-pfc200 (same device)
Touch Panel 600 Advanced Firmware· WAGO
95%
16 ≤ v < 222223
Affected range stops below 22, so it looks safe — our inference, not a vendor statement
wago-touch-panel-600-advanced (same device)
Touch Panel 600 Marine Firmware· WAGO
95%
16 ≤ v < 222223
Affected range stops below 22, so it looks safe — our inference, not a vendor statement
wago-touch-panel-600-marine (same device)
Touch Panel 600 Standard Firmware· WAGO
95%
16 ≤ v < 222223
Affected range stops below 22, so it looks safe — our inference, not a vendor statement
wago-touch-panel-600-standard (same device)
Compact Controller CC100· WAGO
60%
FW16 ≤ v < FW22FW16FW23
Affected range stops below FW22, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in FW22 Patch 1 (unaffected)
Edge Controller· WAGO
60%
FW18 ≤ v < FW22FW18FW23
Affected range stops below FW22, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in FW22 Patch 1 (unaffected)
PFC100· WAGO
60%
FW16 ≤ v < FW22FW16FW23
Affected range stops below FW22, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in FW22 Patch 1 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (1)

MitigationThird Party Advisory
Source: [email protected]
https://cert.vde.com/en/advisories/VDE-2022-060/

CVSS

6.1MEDIUMCERTVDE
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-79

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card