CVE-2022-22511
WAGO PLCs WBM vulnerable to reflected XSS
Various configuration pages of the device are vulnerable to reflected XSS (Cross-Site Scripting) attacks. An authorized attacker with user privileges may use this to gain access to confidential information on a PC that connects to the WBM after it has been compromised.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
WAGO PLCs WBM vulnerable to reflected XSS
Various configuration pages of the device are vulnerable to reflected XSS (Cross-Site Scripting) attacks. An authorized attacker with user privileges may use this to gain access to confidential information on a PC that connects to the WBM after it has been compromised.
- Record
CVE-2022-22511- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2022-27657
Various configuration pages of the device are vulnerable to reflected XSS (Cross-Site Scripting) attacks. An authorized attacker with user privileges may use this to gain access to confidential information on a PC that connects to the WBM after it has been compromised.
- Record
EUVD-2022-27657- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9vh8-h9vp-88fv
Various configuration pages of the device are vulnerable to reflected XSS (Cross-Site Scripting)...
Various configuration pages of the device are vulnerable to reflected XSS (Cross-Site Scripting) attacks. An authorized attacker with user privileges may use this to gain access to confidential information on a PC that connects to the WBM after it has been compromised.
- Record
GHSA-9vh8-h9vp-88fv- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Various configuration pages of the device are vulnerable to reflected XSS (Cross-Site Scripting) attacks. An authorized attacker with user privileges may use this to gain access to confidential information on a PC that connects to the WBM after it has been compromised.
- Record
CVE-2022-22511- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
- wago 750-8100 firmware
- wago 750-8101\/025-000 firmware
- wago 750-8101 firmware
- wago 750-8102\/025-000 firmware
- wago 750-8102 firmware
- wago 750-8202\/000-012 firmware
- wago 750-8202\/000-022 firmware
- wago 750-8202\/025-000 firmware
- wago 750-8202\/025-001 firmware
- wago 750-8202 firmware
- wago 750-82 firmware
- wago 751-9301 firmware
Show 20 moreShow less
- wago 752-8303\/8000-002 firmware
- wago 762-4205\/8000-002 firmware
- wago 762-4206\/8000-002 firmware
- wago 762-4305\/8000-002 firmware
- wago 762-4306\/8000-002 firmware
- wago 762-5205\/8000-001 firmware
- wago 762-5206\/8000-001 firmware
- wago 762-5305\/8000-002 firmware
- wago 762-5306\/8000-002 firmware
- wago 762-6301\/8000-002 firmware
- wago 762-6302\/8000-002 firmware
- wago 762-6303\/8000-002 firmware
- wago 762-6304\/8000-002 firmware
- wago compact controller cc100 (751-9301)
- wago edge controller (752-8303/8000-002)
- wago series pfc100 (750-81xx/xxx-xxx)
- wago series pfc200 (750-82xx/xxx-xxx)
- wago series touch panel 600 advanced line (762-5xxx)
- wago series touch panel 600 marine line (762-6xxx)
- wago series touch panel 600 standard line (762-4xxx)
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-22511 is a medium vulnerability (CVSS 5.4) in Wago 750-8100 Firmware, published March 9, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. No source names a fixed version.