CVE-2022-3738: Wago CC100 Firmware

Medium severity, CVSS 5.9. EPSS: 0.6% chance of exploitation in the next 30 days.

The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like credentials and cryptographic material. A valid user has to create a backup after the last reboot for this attack to be successfull.

Affected products

• Wago CC100 Firmware: from 16, up to and including 22
• Wago Edge Controller Firmware: from 16, up to and including 22
• Wago PFC100 Firmware: from 16, up to and including 22
• Wago PFC200 Firmware: from 16, up to and including 22
• Wago Touch Panel 600 Advanced Firmware: from 16, up to and including 22
• Wago Touch Panel 600 Marine Firmware: from 16, up to and including 22
• Wago Touch Panel 600 Standard Firmware: from 16, up to and including 22

Published 2023-01-19. Last modified 2026-06-17.