How severe is CVE-2023-3379?

CVE-2023-3379 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability low.

Is CVE-2023-3379 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (10th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-3379?

CVE-2023-3379 primarily affects Wago Compact Controller 100 Firmware. In total, 13 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2023-3379?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2023-3379 published?

CVE-2023-3379 was published on 2023-11-20 and last updated on 2026-06-17.

CVE-2023-3379

CVE-2023-3379 is a medium-severity vulnerability in Wago Compact Controller 100 Firmware with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-863.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
EPSS exploit prediction: 0% (10th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-863
Affected product: Wago Compact Controller 100 Firmware
Published: 2023-11-20
Last modified: 2026-06-17

Description

Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker to change the passwords of other non-admin users and thus to escalate non-root privileges.

Frequently asked questions

What is CVE-2023-3379?: Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker to change the passwords of other non-admin users and thus to escalate non-root privileges.
How severe is CVE-2023-3379?: CVE-2023-3379 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability low.
Is CVE-2023-3379 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (10th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-3379?: CVE-2023-3379 primarily affects Wago Compact Controller 100 Firmware. In total, 13 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2023-3379?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2023-3379 published?: CVE-2023-3379 was published on 2023-11-20 and last updated on 2026-06-17.

References

https://cert.vde.com/en/advisories/VDE-2023-015/

Affected products (13)

cpe:2.3:o:wago:compact_controller_100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:wago:edge_controller_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:wago:pfc100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:wago:pfc100_firmware:22:-:*:*:*:*:*:*
cpe:2.3:o:wago:pfc100_firmware:22:patch_1:*:*:*:*:*:*
cpe:2.3:o:wago:pfc200_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:wago:pfc200_firmware:22:-:*:*:*:*:*:*
cpe:2.3:o:wago:pfc200_firmware:22:patch_1:*:*:*:*:*:*
cpe:2.3:o:wago:pfc200_firmware:23:*:*:*:*:*:*:*
cpe:2.3:o:wago:pfc200_firmware:24:*:*:*:*:*:*:*
cpe:2.3:o:wago:touch_panel_600_advanced_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:wago:touch_panel_600_marine_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:wago:touch_panel_600_standard_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Wago Compact Controller 100 Firmware

CVE-2023-1698 — Critical (CVSS 9.8): In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change…
CVE-2023-4089 — Low (CVSS 2.7): On affected Wago products an remote attacker with administrative privileges can access files to which he has already…

All CVEs affecting Wago Compact Controller 100 Firmware →

Other CWE-863 (Incorrect Authorization) vulnerabilities

CVE-2026-48286 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization…
CVE-2026-48303 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization…
CVE-2026-44330 — Critical (CVSS 10.0): free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the…
CVE-2026-46595 — Critical (CVSS 10.0): Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of…
CVE-2026-33105 — Critical (CVSS 10.0): Improper authorization in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over…
CVE-2026-32213 — Critical (CVSS 10.0): Improper authorization in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.

Browse all CWE-863 (Incorrect Authorization) vulnerabilities →