cve/2023/CVE-2023-1698.md

### [CVE-2023-1698](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1698)
![](https://img.shields.io/static/v1?label=Product&message=Compact%20Controller%20CC100&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Edge%20Controller&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=PFC100&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=PFC200&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Touch%20Panel%20600%20Advanced%20Line&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Touch%20Panel%20600%20Marine%20Line&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Touch%20Panel%20600%20Standard%20Line&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20FW22%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Version&message=FW20%3C%3D%20FW22%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-78%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20OS%20Command%20('OS%20Command%20Injection')&color=brighgreen)

### Description

In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behaviour, Denial of Service and full system compromise.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/Chocapikk/CVE-2023-1698
- https://github.com/codeb0ss/CVE-2023-1698-PoC
- https://github.com/deIndra/CVE-2023-1698
- https://github.com/izj007/wechat
- https://github.com/nomi-sec/PoC-in-GitHub
- https://github.com/thedarknessdied/WAGO-CVE-2023-1698
- https://github.com/wy876/POC
- https://github.com/wy876/wiki