CVE-2023-5872 - Vulnerability Details - OpenCVE

In Wago Smart Designer in versions up to 2.33.1 a low privileged remote attacker may enumerate projects and usernames through iterative requests to an specific endpoint.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Wago	Smart Designer

No data.

No data.

References

Link	Providers
https://www.spirityenterprise.com/virtual-ciso
https://www.spirityenterprise.com/mdr-for-endpoint
https://certvde.com/de/advisories/VDE-2023-045
https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2023/vde-2023-045.json

History

Thu, 16 Apr 2026 13:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 16 Apr 2026 05:00:00 +0000

Type	Values Removed	Values Added
Description		In Wago Smart Designer in versions up to 2.33.1 a low privileged remote attacker may enumerate projects and usernames through iterative requests to an specific endpoint.
Title		Wago: Vulnerability in Smart Designer Web-Application
First Time appeared		Wago Wago smart Designer
Weaknesses		CWE-203
CPEs		cpe:2.3:a:wago:smart_designer::::::::
Vendors & Products		Wago Wago smart Designer
References		https://certvde.com/de/advisories/VDE-2023-045 https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2023/vde-2023-045.json
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published: 2026-04-16T04:55:36.146Z

Updated: 2026-04-16T12:59:27.608Z

Reserved: 2023-10-31T07:22:47.201Z

Link: CVE-2023-5872

Vulnrichment

Updated: 2026-04-16T12:59:24.306Z

NVD

Status : Received

Published: 2026-04-16T05:16:12.373

Modified: 2026-04-16T05:16:12.373

Link: CVE-2023-5872

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-5872", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "state": "PUBLISHED", "assignerShortName": "CERTVDE", "dateReserved": "2023-10-31T07:22:47.201Z", "datePublished": "2026-04-16T04:55:36.146Z", "dateUpdated": "2026-04-16T12:59:27.608Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Smart Designer", "vendor": "Wago", "versions": [{"lessThanOrEqual": "2.33.1", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wago:smart_designer:*:*:*:*:*:*:*:*", "versionEndIncluding": "2.33.1", "versionStartIncluding": "0.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "credits": [{"lang": "en", "type": "reporter", "value": "Brett Dewall from White Oak Security"}], "datePublic": "2023-12-05T07:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">In Wago Smart Designer in versions up to 2.33.1 a low privileged remote attacker may enumerate projects and usernames through iterative requests to an specific endpoint.</span><br>"}], "value": "In Wago Smart Designer in versions up to 2.33.1 a low privileged remote attacker may enumerate projects and usernames through iterative requests to an specific endpoint."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-203", "description": "CWE-203 Observable Discrepancy", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2026-04-16T04:55:36.146Z"}, "references": [{"url": "https://certvde.com/de/advisories/VDE-2023-045"}, {"tags": ["vendor-advisory"], "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2023/vde-2023-045.json"}], "source": {"advisory": "VDE-2023-045", "discovery": "UNKNOWN"}, "title": "Wago: Vulnerability in Smart Designer Web-Application", "x_generator": {"engine": "Vulnogram 0.4.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-16T12:59:20.406412Z", "id": "CVE-2023-5872", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T12:59:27.608Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-5872", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "state": "PUBLISHED", "assignerShortName": "CERTVDE", "dateReserved": "2023-10-31T07:22:47.201Z", "datePublished": "2026-04-16T04:55:36.146Z", "dateUpdated": "2026-04-16T12:59:27.608Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Smart Designer", "vendor": "Wago", "versions": [{"lessThanOrEqual": "2.33.1", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wago:smart_designer:*:*:*:*:*:*:*:*", "versionEndIncluding": "2.33.1", "versionStartIncluding": "0.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "credits": [{"lang": "en", "type": "reporter", "value": "Brett Dewall from White Oak Security"}], "datePublic": "2023-12-05T07:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">In Wago Smart Designer in versions up to 2.33.1 a low privileged remote attacker may enumerate projects and usernames through iterative requests to an specific endpoint.</span><br>"}], "value": "In Wago Smart Designer in versions up to 2.33.1 a low privileged remote attacker may enumerate projects and usernames through iterative requests to an specific endpoint."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-203", "description": "CWE-203 Observable Discrepancy", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2026-04-16T04:55:36.146Z"}, "references": [{"url": "https://certvde.com/de/advisories/VDE-2023-045"}, {"tags": ["vendor-advisory"], "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2023/vde-2023-045.json"}], "source": {"advisory": "VDE-2023-045", "discovery": "UNKNOWN"}, "title": "Wago: Vulnerability in Smart Designer Web-Application", "x_generator": {"engine": "Vulnogram 0.4.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-5872", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-16T12:59:20.406412Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T12:59:24.306Z"}}]}}