CVE-2015-6472

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

WAGO IO 750-849 01.01.27 and 01.02.05, WAGO IO 750-881, and WAGO IO 758-870 have weak credential management.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-255

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/136077/WAGO-IO-PLC-758-870-750-849-Credential-Management-Privilege-Separation.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2016/Mar/4Exploit, Mailing List, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/84138Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/136077/WAGO-IO-PLC-758-870-750-849-Credential-Management-Privilege-Separation.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2016/Mar/4Exploit, Mailing List, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/84138Third Party Advisory, VDB Entry

Timeline

Published: Aug 22, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-64739.8WAGO IO 750-849 01.01.27 and WAGO IO 750-881 01.02.05 do not contain privilege separation.CVE-2015-64745.0IBC Solar ServeMaster TLP+ and Danfoss TLX Pro+ allow remote attackers to discover cleartext passwords by reading HTML source code.CVE-2015-64754.3Multiple cross-site scripting (XSS) vulnerabilities in IBC Solar ServeMaster TLP+ and Danfoss TLX Pro+ allow remote attackers to inject arbi CVE-2015-647610.0Advantech EKI-122x-BE devices with firmware before 1.65, EKI-132x devices with firmware before 1.98, and EKI-136x devices with firmware befo CVE-2015-64776.1Multiple cross-site scripting (XSS) vulnerabilities in the Wind Farm Portal application in Nordex Control 2 (NC2) SCADA 16 and earlier allow CVE-2015-64786.8Unitronics VisiLogic OPLC IDE before 9.8.02 does not properly restrict access to ActiveX controls, which allows remote attackers to have an CVE-2015-64794.3ACEmanager in Sierra Wireless ALEOS 4.4.2 and earlier on ES440, ES450, GX400, GX440, GX450, and LS300 devices allows remote attackers to rea CVE-2015-64808.3The MessageBrokerServlet servlet in Moxa OnCell Central Manager before 2.2 does not require authentication, which allows remote attackers to CVE-2015-64818.3The login function in the RequestController class in Moxa OnCell Central Manager before 2.2 has a hardcoded root password, which allows remo CVE-2015-64825.0Runtime Toolkit before 2.4.7.48 in 3S-Smart CODESYS before 2.3.9.48 allows remote attackers to cause a denial of service (NULL pointer deref CVE-2015-64845.03S-Smart CODESYS Gateway Server before 2.3.9.48 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon cr CVE-2015-64855.3Schneider Electric Telvent Sage 2300 RTUs with firmware before C3413-500-S01, and LANDAC II-2, Sage 1410, Sage 1430, Sage 1450, Sage 2400, a