CVE-2023-4149

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability in the web-based management allows an unauthenticated remote attacker to inject arbitrary system commands and gain full system control. Those commands are executed with root privileges. The vulnerability is located in the user request handling of the web-based management.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
WAGOIndustrial Managed Switch (0852-0602)< 1.0.6.S0
WAGOIndustrial Managed Switch (0852-0603)< 1.0.6.S0
WAGOIndustrial Managed Switch (0852-1605)< 1.2.5.S0

References

Timeline

Published
Nov 21, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-41504.3The User Activity Tracking and Log WordPress plugin before 4.0.9 does not have proper CSRF checks when managing its license, which could allCVE-2023-415039.8Student Enrollment In PHP v1.0 was discovered to contain a SQL injection vulnerability via the Login function.CVE-2023-415048.8SQL Injection vulnerability in Student Enrollment In PHP 1.0 allows attackers to run arbitrary code via the Student Search function.CVE-2023-415059.8An arbitrary file upload vulnerability in the Add Student's Profile Picture function of Student Enrollment In PHP v1.0 allows attackers to eCVE-2023-415069.8An arbitrary file upload vulnerability in the Update/Edit Student's Profile Picture function of Student Enrollment In PHP v1.0 allows attackCVE-2023-415079.8Super Store Finder v3.6 was discovered to contain multiple SQL injection vulnerabilities in the store locator component via the products, diCVE-2023-415089.8A hard coded password in Super Store Finder v3.6 allows attackers to access the administration panel.CVE-2023-41516.1The Store Locator WordPress plugin before 1.4.13 does not sanitise and escape an invalid nonce before outputting it back in an AJAX responseCVE-2023-415196.1Student Attendance Management System v1 was discovered to contain a cross-site scripting (XSS) vulnerability via the sessionName parameter aCVE-2023-41527.5Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a path traversal vulnerability of theCVE-2023-415208.8Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createClassArms.php via the clasCVE-2023-415218.8Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createSessionTerm.php via the id