Wago CC100 0751/9x01 vulnerabilities

8 CVEs affecting Wago CC100 0751/9x01, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-41974, published 2024-11-18.

More from Wago.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-41973, published 2024-11-18. High severity, CVSS 8.1. EPSS: 0.6% chance of exploitation in the next 30 days. A low privileged remote attacker can specify an arbitrary file on the filesystem which may lead to an arbitrary file writes with root privileges.
• CVE-2024-41971, published 2024-11-18. High severity, CVSS 8.1. EPSS: 0.6% chance of exploitation in the next 30 days. A low privileged remote attacker can overwrite an arbitrary file on the filesystem leading to a DoS and data loss.
• CVE-2024-41972, published 2024-11-18. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. A low privileged remote attacker can overwrite an arbitrary file on the filesystem which may lead to an arbitrary file read with root privileges.
• CVE-2024-41969, published 2024-11-18. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. A low privileged remote attacker may modify the configuration of the CODESYS V3 service through a missing authentication vulnerability which could lead to full system access and/or DoS.
• CVE-2024-41967, published 2024-11-18. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. A low privileged remote attacker may modify the boot mode configuration setup of the device, leading to modification of the firmware upgrade process or a denial-of-service attack.
• CVE-2024-41974, published 2024-11-18. High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days. A low privileged remote attacker may modify the BACNet service properties due to incorrect permission assignment for critical resources which may lead to a DoS limited to BACNet communication.
• CVE-2024-41970, published 2024-11-18. Medium severity, CVSS 5.7. EPSS: 0.3% chance of exploitation in the next 30 days. A low privileged remote attacker may gain access to forbidden diagnostic data due to incorrect permission assignment for critical resources.
• CVE-2024-41968, published 2024-11-18. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. A low privileged remote attacker may modify the docker settings setup of the device, leading to a limited DoS.