CVE-2018-12979

An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. Weak permissions allow an authenticated user to overwrite critical files by abusing the unrestricted file upload in the WBM.

• CWE-732

• https://seclists.org/fulldisclosure/2018/Jul/38Exploit, Mailing List, Third Party Advisory
• https://cert.vde.com/en-us/advisories/vde-2018-010Third Party Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-18-198-02Third Party Advisory, US Government Resource
• https://www.exploit-db.com/exploits/45014/Exploit, Third Party Advisory, VDB Entry
• https://www.sec-consult.com/en/blog/advisories/remote-code-execution-via-multiple-attack-vectors-in-wago-edisplay/Exploit, Third Party Advisory
• https://www.wago.com/medias/SA-WBM-2018-004.pdf?context=bWFzdGVyfHJvb3R8MjgyNzYwfGFwcGxpY2F0aW9uL3BkZnxoMWUvaDg4LzkzNjE3NTIxOTUxMDIucGRmfDU1NmJkYjEzNDY0ZGU4OWQ1OTMyMjUwNTlmZTI0MzgwNDQ1MDY1YzU3OWRmZDk1NzYzODAwMDI3ODg1NDJlZjUThird Party Advisory
• https://seclists.org/fulldisclosure/2018/Jul/38Exploit, Mailing List, Third Party Advisory
• https://cert.vde.com/en-us/advisories/vde-2018-010Third Party Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-18-198-02Third Party Advisory, US Government Resource
• https://www.exploit-db.com/exploits/45014/Exploit, Third Party Advisory, VDB Entry
• https://www.sec-consult.com/en/blog/advisories/remote-code-execution-via-multiple-attack-vectors-in-wago-edisplay/Exploit, Third Party Advisory
• https://www.wago.com/medias/SA-WBM-2018-004.pdf?context=bWFzdGVyfHJvb3R8MjgyNzYwfGFwcGxpY2F0aW9uL3BkZnxoMWUvaDg4LzkzNjE3NTIxOTUxMDIucGRmfDU1NmJkYjEzNDY0ZGU4OWQ1OTMyMjUwNTlmZTI0MzgwNDQ1MDY1YzU3OWRmZDk1NzYzODAwMDI3ODg1NDJlZjUThird Party Advisory

Published

Jul 12, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-12971EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll …
• CVE-2018-12972An issue was discovered in OpenTSDB 2.3.0. Many parameters t…
• CVE-2018-12973An issue was discovered in OpenTSDB 2.3.0. There is XSS in p…
• CVE-2018-12975The random() function of the smart contract implementation f…
• CVE-2018-12976In Go Doc Dot Org (gddo) through 2018-06-27, an attacker cou…
• CVE-2018-12977A SQL injection vulnerability in the SoftExpert (SE) Excelle…
• CVE-2018-1298A Denial of Service vulnerability was found in Apache Qpid B…
• CVE-2018-12980An issue was discovered on WAGO e!DISPLAY 762-3000 through 7…8.8
• CVE-2018-12981An issue was discovered on WAGO e!DISPLAY 762-3000 through 7…5.4
• CVE-2018-12982Invalid memory read in the PoDoFo::PdfVariant::DelayedLoad()…
• CVE-2018-12983A stack-based buffer over-read in the PdfEncryptMD5Base::Com…
• CVE-2018-12984Hycus CMS 1.0.4 allows Authentication Bypass via "'=' 'OR'" …