CVE-2023-1698: WAGO PFC100/PFC200 Unauthenticated OS Command Injection via Web-Based Management

CVE-2023-1698 is a critical OS command injection vulnerability (CWE-78) in the web-based management interface that WAGO ships on its PFC100 and PFC200 programmable logic controllers, plus its Compact Controller 100, Edge Controller and Touch Panel 600 product lines: an unauthenticated remote attacker can send a crafted request to the management interface to create new administrative users, change the device's configuration, and run arbitrary operating-system commands, and CERT@VDE's own coordinated score for the flaw is CVSS v3.1 9.8 (critical); NVD has not yet published its own Primary CVSS score.

CVE-2023-1698 (CWE-78, OS command injection) affects the web-based management (WBM) interface built into WAGO's PFC100 and PFC200 programmable controllers, Compact Controller 100, Edge Controller and Touch Panel 600 devices. NVD's description states: "In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behaviour, Denial of Service and full system compromise" (NVD).

CERT@VDE's coordinated advisory VDE-2023-007 attributes the flaw to the WBM's "legal information" plugin, describing it as allowing "execution of arbitrary commands with privileges of www user," which an attacker can use to modify device configuration and compromise the system. The advisory credits Quentin Kaiser of ONEKEY with reporting the issue, and lists the affected hardware with their WAGO item numbers: Compact Controller 100 (751-9301), Edge Controller (752-8303/8000-002), PFC100 (750-81xx), PFC200 (750-821x/750-82xx) and the Touch Panel 600 Advanced, Marine and Standard lines (762-5xxx/762-6xxx/762-4xxx) (CERT@VDE VDE-2023-007).

NVD tracks CVE-2023-1698 with status "Modified" as of this review: it records only a CERT@VDE-submitted score (source [email protected]) — CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — typed Secondary, not NVD's own Primary rating, so this page does not show a headline severity score rather than presenting that figure as NVD-confirmed (NVD). The PR:N and UI:N components of that vector mean the vendor-coordinated analysis treats this as remotely exploitable with no authentication and no user interaction at all, consistent with NVD's plain-text description of an unauthenticated attacker creating new users outright.

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.81911 (99.653rd percentile) as of 2026-11-07, a notably high figure for a device-firmware CVE that reflects how straightforward the unauthenticated command-injection path is to automate (CISA KEV, FIRST EPSS).

NVD has not finished its own severity analysis. In the meantime, operators of affected WAGO controllers and panels should update to the fixed firmware WAGO lists for each model (FW22 SP1, FW24 or later depending on product), and avoid exposing the web-based management interface directly to untrusted networks.

• In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behaviour, Denial of Service and full system compromise. — NVD
• The WBM's 'legal information' plugin allows execution of arbitrary commands with privileges of the www user; affects Compact Controller 100 (751-9301), Edge Controller (752-8303/8000-002), PFC100 (750-81xx), PFC200 (750-821x/750-82xx) and Touch Panel 600 Advanced/Marine/Standard Line; reported by Quentin Kaiser of ONEKEY. — CERT@VDE VDE-2023-007
• NVD status 'Modified'; records only CERT@VDE's own Secondary CVSS v3.1 score of 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; no NVD-published Primary score as of this review. — NVD
• Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.81911 (99.653rd percentile) as of 2026-11-07. — FIRST EPSS