CVE-2023-1698

What it actually does

The vulnerability permits unauthenticated remote manipulation of affected WAGO device functionality, including creation of new user accounts and modification of device configuration. Because exploitation requires network access but no credentials, user interaction, or prior privileges, a reachable vulnerable device can be taken over remotely. Technical outcomes can include unauthorized administrative access, persistent configuration changes, disruption of device operation, denial of service, and full compromise of the affected system. The provided metadata classifies the issue as command injection and lists weaponized exploit maturity with a high EPSS score, indicating elevated likelihood of real-world exploitation where exposed systems remain unpatched.

Why it matters to the business

Successful exploitation can let an attacker alter industrial or embedded device behavior, create backdoor accounts, interrupt operations, and potentially use the device as a foothold into adjacent networks. For organizations using affected products in operational technology, building automation, manufacturing, or remote-control environments, this can translate into downtime, unsafe or unintended process behavior, emergency maintenance, loss of visibility or control, and incident response costs. Although this is not listed in CISA KEV and is not marked as ransomware-used in the supplied data, the high CVSS score, weaponized exploit maturity, and high EPSS probability make externally reachable devices a priority for rapid remediation.

How an attack unfolds

An attacker first identifies exposed affected devices through internet scanning, asset inventory leaks, or access to an internal network segment. The attacker then sends crafted unauthenticated requests to the vulnerable device interface that abuse the flaw to create a new user or modify configuration without authorization. If command injection behavior is reachable in the vulnerable workflow, the attacker may execute attacker-controlled commands or use configuration changes to gain durable control. After initial compromise, the attacker can log in using the newly created account, change operational settings, disable or disrupt services, collect sensitive configuration data, and attempt lateral movement into connected management or industrial networks. Because public weaponization is indicated, exploitation may be automated against internet-facing assets.

How to fix it

Upgrade affected products to vendor-fixed releases as soon as possible. For the package data supplied, Debian 11 chromium should be updated to 115.0.5790.98-1~deb11u1 or later. For WAGO devices, apply the corresponding vendor firmware or software update for the exact model and product line, then reboot or restart services as required by the vendor. If immediate patching is not possible, restrict management interfaces to trusted administration networks only, block internet exposure, enforce VPN or jump-host access, apply firewall allowlists, disable unused services, rotate credentials, remove unknown accounts, and back up then review device configuration for unauthorized changes. Because the supplied affected-product metadata appears package-specific while the vulnerability description references WAGO products, validate remediation against authoritative vendor advisories for each deployed asset type rather than relying on product name alone.

How to confirm the fix worked

Confirm exposure by inventorying affected devices and packages, validating firmware or package versions, and checking whether remote management interfaces are reachable from untrusted networks. On Debian 11 systems using the supplied package data, verify that chromium is at 115.0.5790.98-1~deb11u1 or later using package-management tooling. For WAGO devices, verify the installed firmware/software version against the vendor advisory and confirm the fixed version is active after reboot. Validate mitigations by confirming management ports are not reachable from the internet or unauthorized segments, reviewing local user lists for unexpected accounts, comparing current configuration against known-good baselines, and testing that unauthenticated requests cannot create users or modify configuration.

Typical attack path

1. Scan for internet-facing or internally reachable affected WAGO devices or vulnerable packaged software versions.
2. Fingerprint the device or service version and confirm the vulnerable management interface is reachable.
3. Send crafted unauthenticated requests that trigger unauthorized user creation, configuration modification, or command injection behavior.
4. Authenticate using the newly created account or rely on the modified configuration to establish control.
5. Change device settings, disable services, extract configuration data, or deploy persistence where supported by the platform.
6. Use the compromised device as an operational disruption point or pivot into adjacent management, OT, or enterprise networks.

How to detect it

Investigate whether affected devices were reachable from the internet or untrusted network segments during the exposure window. Review device audit logs, web or management-interface logs, authentication logs, configuration-change logs, firmware update logs, firewall logs, VPN logs, proxy logs, and network flow records. Look for unauthenticated requests followed by account creation, new administrator users, configuration exports or imports, service restarts, unexplained device reboots, changes to network settings, unusual outbound connections, and access from unfamiliar IP addresses. Compare device configuration against a known-good baseline and review all local users, roles, SSH keys, certificates, and remote-management settings. For command-injection-style activity, look for management requests containing shell metacharacters, command separators, encoded payloads, download-and-execute patterns, or references to common Unix utilities used during post-exploitation. If no device-level logs are available, rely on perimeter logs and packet captures around management ports to identify suspicious administrative activity and bulk scanning.

What your security team should do

• Immediately identify all affected WAGO devices and any Debian 11 chromium packages matching the supplied affected-product data, prioritizing internet-facing or remotely managed assets.
• Patch or upgrade to vendor-fixed versions; for Debian 11 chromium, deploy 115.0.5790.98-1~deb11u1 or later.
• Remove direct internet exposure for device management interfaces and enforce network segmentation, VPN, jump-host, and firewall allowlist controls.
• Audit affected devices for newly created or unknown users, unexpected privilege changes, unauthorized configuration changes, and recent reboots or service interruptions.
• Rotate credentials and API tokens associated with affected devices after patching, especially if exposure existed before remediation.
• Collect and preserve logs from device management interfaces, network firewalls, VPNs, authentication systems, and remote administration infrastructure before they roll over.
• Create detection logic for unauthenticated configuration changes, account creation events, repeated requests to management endpoints, and connections from unusual external IP addresses.
• If exploitation is suspected, isolate the device, capture configuration and logs, reimage or factory-reset if recommended by the vendor, restore known-good configuration, and monitor adjacent network segments for follow-on activity.