Back to KEVs

CVE-2023-1698

WAGO: WBM Command Injection in multiple products

Basic Information

CVE State
PUBLISHED
Reserved Date
March 29, 2023
Published Date
May 15, 2023
Last Updated
January 23, 2025
Vendor
WAGO
Product
Compact Controller CC100, Edge Controller, PFC100, PFC200, Touch Panel 600 Advanced Line, Touch Panel 600 Marine Line, Touch Panel 600 Standard Line
Description
In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behaviour, Denial of Service and full system compromise.
Tags
nuclei_scanner

CVSS Scores

CVSS v3.1

9.8 - CRITICAL

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Score
93.61% (Percentile: 99.83%) as of 2025-07-29

SSVC Information

Exploitation
none
Automatable
Yes
Technical Impact
total

Exploit Status

Exploited in the Wild
Yes (2025-07-07 00:00:00 UTC) Source

References

https://cert.vde.com/en/advisories/VDE-2023-007/

Known Exploited Vulnerability Information

Source Added Date
The Shadowserver (via CIRCL) 2025-07-08 12:01:44 UTC

Scanner Integrations

Scanner URL Date Detected
Nuclei https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1698.yaml 2025-04-26 00:00:00 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

X3RX3SSec/CVE-2023-1698

Type: github • Created: 2025-02-21 15:38:24 UTC • Stars: 3

CVE-2023-1698 Proof of Concept (PoC)

thedarknessdied/WAGO-CVE-2023-1698

Type: github • Created: 2023-10-20 12:15:39 UTC • Stars: 2

WAGO系统远程代码执行漏洞(CVE-2023-1698)

Chocapikk/CVE-2023-1698

Type: github • Created: 2023-09-15 20:06:31 UTC • Stars: 3

WAGO Remote Exploit Tool for CVE-2023-1698

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Detected by Nuclei

  • Added to KEVIntel